Is The Plus Addons for Elementor safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (6.6.0). As of 2026-11-04. 40 issues are on record for older versions; version 6.6.0 or newer fixes all of them that state a fix. Keep The Plus Addons for Elementor on the latest version (6.6.0) and remove it if you do not use it.

Which versions of The Plus Addons for Elementor are vulnerable?

Known issues on record (newest first): Stored cross-site scripting (XSS) (6.5.3 and older, fixed in 6.6.0); Cross-site scripting (XSS) (6.5.1 and older, fixed in 6.5.2); Stored cross-site scripting (XSS) (6.4.11 and older, fixed in 6.4.12); Stored cross-site scripting (XSS) (6.4.15 and older, fixed in 6.4.16); Stored cross-site scripting (XSS) (6.4.9 and older, fixed in 6.4.10); Security issue (6.4.7 and older, fixed in 6.4.8). The full list with sources is on this page.

What is the latest version of The Plus Addons for Elementor?

6.6.0, according to wordpress.org (last updated 2026-10-27). It has 100,000+ active installs.

What should I do if my The Plus Addons for Elementor is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update the-plus-addons-for-elementor-page-builder). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · the-plus-addons-for-elementor-page-builder · data as of 2026-11-04

Is The Plus Addons for Elementor safe? Known vulnerabilities and latest version

Latest version: 6.6.0
Last updated: 2026-10-27
Active installs: 100,000+
Known issues on record: 40
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 7.4+

120+ Elementor widgets, AI tools, Mega Menu, WooCommerce, Header Footer & Popup Builder, Blog Builder & 1000+ templates. Connect any MCP AI agent. — by POSIMYTH

What to do

Update to the latest version (6.6.0). Anything older than 6.6.0 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get the-plus-addons-for-elementor-page-builder --field=version shows what you run; wp plugin update the-plus-addons-for-elementor-page-builder updates it.

Check your version

Known vulnerabilities

40 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 6.5 CVE-2026-116848 · published 2026-10-29

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.5.3 and older)

Affected: 6.5.3 and older
Fixed in: 6.6.0
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.

NVD CVE-2026-116848 Patchstack advisory

medium 6.5 CVE-2026-96829 · published 2026-09-30

Cross-site scripting (XSS) in The Plus Addons for Elementor (6.5.1 and older)

Affected: 6.5.1 and older
Fixed in: 6.5.2
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

NVD CVE-2026-96829 Patchstack advisory

medium 6.4 CVE-2026-15285 · published 2026-07-10

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.11 and older)

Affected: 6.4.11 and older
Fixed in: 6.4.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.

NVD CVE-2026-15285 Wordfence advisory Plugin source

medium 6.4 CVE-2026-9243 · published 2026-05-29

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.15 and older)

Affected: 6.4.15 and older
Fixed in: 6.4.16 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-9243 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-5243 · published 2026-05-14

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.11 and older)

Affected: 6.4.11 and older
Fixed in: 6.4.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scripting via the `menu_hover_click` parameter of the Navigation Menu Lite widget in all versions up to, and including, 6.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-5243 Wordfence advisory Code change (fix)

medium 6.4 CVE-2026-3311 · published 2026-04-08

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.9 and older)

Affected: 6.4.9 and older
Fixed in: 6.4.10 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Progress Bar shortcode in all versions up to, and including, 6.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-3311 Wordfence advisory Code change (fix)

medium 5.3 CVE-2026-2385 · published 2026-02-22

Security issue in The Plus Addons for Elementor (6.4.7 and older)

Affected: 6.4.7 and older
Fixed in: 6.4.8 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.

NVD CVE-2026-2385 Wordfence advisory Code change (fix)

medium 4.3 CVE-2026-2386 · published 2026-02-18

Missing authorization check in The Plus Addons for Elementor (6.4.7 and older)

Affected: 6.4.7 and older
Fixed in: 6.4.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter.

NVD CVE-2026-2386 Wordfence advisory Code change (fix)

medium 6.5 CVE-2024-23511 · published 2026-01-05

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.3.3 and older)

Affected: 5.3.3 and older
Fixed in: 5.3.4
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.3.3.

NVD CVE-2024-23511 Patchstack advisory

medium 6.8 CVE-2025-9698 · published 2025-10-13

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (older than 6.3.16)

Affected: older than 6.3.16
Fixed in: 6.3.16
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.

NVD CVE-2025-9698 WPScan advisory

medium 6.5 CVE-2025-55712 · published 2025-08-14

Missing authorization check in The Plus Addons for Elementor (6.3.13 and older)

Affected: 6.3.13 and older
Fixed in: 6.3.14
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.3.13.

NVD CVE-2025-55712 Patchstack advisory

medium 6.4 CVE-2025-7646 · published 2025-08-01

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.3.10 and older)

Affected: 6.3.10 and older
Fixed in: 6.3.11 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfiltered_html capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-7646 Wordfence advisory Plugin source

medium 6.5 CVE-2025-49076 · published 2025-06-06

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.2.7 and older)

Affected: 6.2.7 and older
Fixed in: 6.2.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.2.7.

NVD CVE-2025-49076 Patchstack advisory

medium 5.4 CVE-2025-1287 · published 2025-03-08

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.2.2 and older)

Affected: 6.2.2 and older
Fixed in: 6.2.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-1287 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-11829 · published 2025-02-01

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.1.8 and older)

Affected: 6.1.8 and older
Fixed in: 6.2.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Widget's searchable_label parameter in all versions up to, and including, 6.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-11829 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-53823 · published 2024-12-06

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.14 and older)

Affected: 5.6.14 and older
Fixed in: 6.0.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.14.

NVD CVE-2024-53823 Patchstack advisory

medium 4.3 CVE-2024-10365 · published 2024-11-20

Information disclosure in The Plus Addons for Elementor (6.0.3 and older)

Affected: 6.0.3 and older
Fixed in: 6.0.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.

NVD CVE-2024-10365 Wordfence advisory Code change (fix)

high 8.8 CVE-2024-43932 · published 2024-11-01

Missing authorization check in The Plus Addons for Elementor (5.6.2 and older)

Affected: 5.6.2 and older
Fixed in: 5.6.3
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.

NVD CVE-2024-43932 Patchstack advisory

medium 4.3 CVE-2024-8913 · published 2024-10-11

Information disclosure in The Plus Addons for Elementor (5.6.11 and older)

Affected: 5.6.11 and older
Fixed in: 5.6.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.11 via the render function in modules/widgets/tp_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.

NVD CVE-2024-8913 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-43977 · published 2024-09-17

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Affected: 5.6.2 and older
Fixed in: 5.6.3
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

NVD CVE-2024-43977 Patchstack advisory

medium 5.4 CVE-2024-5583 · published 2024-08-22

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Affected: 5.6.2 and older
Fixed in: 5.6.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel_direction parameter of testimonials widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5583 Wordfence advisory Plugin source

medium 5.4 CVE-2024-5763 · published 2024-08-20

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Affected: 5.6.2 and older
Fixed in: 5.6.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_date attribute within the plugin's Video widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5763 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2024-6575 · published 2024-08-20

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Affected: 5.6.2 and older
Fixed in: 5.6.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘res_width_value’ parameter within the plugin's tp_page_scroll widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-6575 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2024-4482 · published 2024-07-03

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.1 and older)

Affected: 5.6.1 and older
Fixed in: 5.6.2 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied 'text_days' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4482 Wordfence advisory wordpress.org Plugin source

medium 5.4 CVE-2024-4983 · published 2024-06-27

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.0 and older)

Affected: 5.6.0 and older
Fixed in: 5.6.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘video_color’ parameter in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4983 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-35709 · published 2024-06-08

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.4 and older)

Affected: 5.5.4 and older
Fixed in: 5.5.5
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.5.4.

NVD CVE-2024-35709 Patchstack advisory Patchstack advisory

medium 5.4 CVE-2024-4484 · published 2024-05-24

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.1 and older)

Affected: 5.5.1 and older
Fixed in: 5.5.2 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘xai_username’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4484 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-4485 · published 2024-05-24

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.2 and older)

Affected: 5.5.2 and older
Fixed in: 5.5.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_custom_attributes’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4485 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-3718 · published 2024-05-24

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.4 and older)

Affected: 5.5.4 and older
Fixed in: 5.5.5 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35709 is likely a duplicate of this issue.

NVD CVE-2024-3718 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-2784 · published 2024-05-24

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.4 and older)

Affected: 5.5.4 and older
Fixed in: 5.5.5 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Hover Card widget in all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-2784 Wordfence advisory Code change (fix)

Show 10 older records

medium 5.4 CVE-2024-2785 · published 2024-05-14

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Affected: 5.4.2 and older
Fixed in: 5.5.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-2785 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-0445 · published 2024-05-14

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Affected: 5.4.2 and older
Fixed in: 5.5.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-34373 is likely a duplicate of this issue.

NVD CVE-2024-0445 Wordfence advisory Plugin source

medium 5.4 CVE-2024-34373 · published 2024-05-06

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Affected: 5.4.2 and older
Fixed in: 5.5.0
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.4.2.

NVD CVE-2024-34373 Patchstack advisory Patchstack advisory

medium 5.4 CVE-2024-3197 · published 2024-05-02

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Affected: 5.4.2 and older
Fixed in: 5.5.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in the plugin's widgets in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3197 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-3199 · published 2024-05-02

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Affected: 5.4.2 and older
Fixed in: 5.5.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3199 Wordfence advisory Code change (fix)Plugin source

high 8.8 CVE-2024-2203 · published 2024-03-27

File inclusion in The Plus Addons for Elementor (5.4.1 and older)

Affected: 5.4.1 and older
Fixed in: 5.4.2 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

NVD CVE-2024-2203 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-2210 · published 2024-03-27

File inclusion in The Plus Addons for Elementor (5.4.1 and older)

Affected: 5.4.1 and older
Fixed in: 5.4.2 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Listing widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

NVD CVE-2024-2210 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-1419 · published 2024-03-07

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.0 and older)

Affected: 5.4.0 and older
Fixed in: 5.4.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ attribute of the Header Meta Content widget in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1419 Wordfence advisory Code change (fix)

high 8.8 CVE-2021-4331 · published 2023-03-07

Privilege escalation in The Plus Addons for Elementor (4.1.9 and older)

Affected: 4.1.9 and older
Fixed in: 5.0.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: advisory text · score by NVD

Details from the advisory

The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin adds a registration form to the Elementor page builders functionality. As part of the registration form, users can choose which role to set as the default for users upon registration. This field is not hidden for lower-level users so any user with access to the Elementor page builder, such as contributors, can set the default role to administrator. Since contributors can not publish posts, only author+ users can elevate privileges without interaction via a site administrator (to approve a post).

NVD CVE-2021-4331 Wordfence advisory Code change (fix)

medium 6.5 CVE-2021-4332 · published 2023-03-07

Path traversal / file read in The Plus Addons for Elementor (2.0.6 and older, 4.0 to 4.1.9)

Affected: 2.0.6 and older, 4.0 to 4.1.9
Fixed in: 5.0.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.

NVD CVE-2021-4332 Wordfence advisory Code change (fix)

Recent activity

2026-10-27 — latest release on wordpress.org (6.6.0).
2026-10-29 — Stored cross-site scripting (XSS) disclosed (CVE-2026-116848), fixed in 6.6.0.
2026-09-30 — Cross-site scripting (XSS) disclosed (CVE-2026-96829), fixed in 6.5.2.
2026-07-10 — Stored cross-site scripting (XSS) disclosed (CVE-2026-15285), fixed in 6.4.12.

Free. We check the CVE feeds every day and email you only when a new issue for The Plus Addons for Elementor (the-plus-addons-for-elementor-page-builder) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (30) · Missing authorization (3) · Sensitive data exposure (2) · File inclusion (2) · Privilege escalation (1) · Path traversal and file read (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/the-plus-addons-for-elementor-page-builder (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/the-plus-addons-for-elementor-page-builder"><img src="https://laskyr.com/plugins/the-plus-addons-for-elementor-page-builder/badge.svg" alt="The Plus Addons for Elementor vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is The Plus Addons for Elementor safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (6.6.0)

What to do

Check your version

Known vulnerabilities

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.5.3 and older)

Cross-site scripting (XSS) in The Plus Addons for Elementor (6.5.1 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.11 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.15 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.11 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.4.9 and older)

Security issue in The Plus Addons for Elementor (6.4.7 and older)

Missing authorization check in The Plus Addons for Elementor (6.4.7 and older)

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.3.3 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (older than 6.3.16)

Missing authorization check in The Plus Addons for Elementor (6.3.13 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.3.10 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.2.7 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.2.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (6.1.8 and older)

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.14 and older)

Information disclosure in The Plus Addons for Elementor (6.0.3 and older)

Missing authorization check in The Plus Addons for Elementor (5.6.2 and older)

Information disclosure in The Plus Addons for Elementor (5.6.11 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.1 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.6.0 and older)

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.4 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.1 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.4 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.5.4 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.2 and older)

File inclusion in The Plus Addons for Elementor (5.4.1 and older)

File inclusion in The Plus Addons for Elementor (5.4.1 and older)

Stored cross-site scripting (XSS) in The Plus Addons for Elementor (5.4.0 and older)

Privilege escalation in The Plus Addons for Elementor (4.1.9 and older)

Path traversal / file read in The Plus Addons for Elementor (2.0.6 and older, 4.0 to 4.1.9)

Recent activity

Get an email when The Plus Addons for Elementor has a new vulnerability

Browse vulnerabilities

Where this data comes from