VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Addon Elements for Elementor (formerly Elementor Addon Elements) security & vulnerabilities

addon-elements-for-elementor-page-builder— active installsLast vulnerability Nov 11, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
34Known vulnerabilities
  • Critical0
  • High1
  • Medium33
  • Low0
Vulnerabilities per year
2020: 1 vulnerability1202021: 2 vulnerabilities2212022: 1 vulnerability1222023: 5 vulnerabilities5232024: 19 vulnerabilities19242025: 3 vulnerabilities3252026: 3 vulnerabilities326

All Addon Elements for Elementor (formerly Elementor Addon Elements) vulnerabilities

Addon Elements for Elementor (formerly Elementor Addon Elements) vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.5Update to 1.5.1
CVE-2026-125743
Medium5.3Unauthenticated Information Exposure
≤1.15Update to 1.15.1
CVE-2026-119465
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.14.4Update to 1.14.5
CVE-2026-114184
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.14.3Update to 1.14.4
CVE-2025-12537
Medium4.3Authenticated (Contributor+) Information Exposure
≤1.14.4Update to 1.14.5
CVE-2026-28131
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup
≤1.13.10Update to 1.14
CVE-2024-13215
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
≤1.13.8Update to 1.13.9
CVE-2024-8902
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.6Update to 1.13.7
CVE-2024-47366
Medium4.3Missing Authorization
≤1.13.6Update to 1.13.7
CVE-2024-47361
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤1.13.6Update to 1.13.7
CVE-2024-7122
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters
≤1.13.5Update to 1.13.6
CVE-2024-4401
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.5Update to 1.13.6
CVE-2024-4570
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.5Update to 1.13.6
CVE-2024-4569
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget
≤1.13.3Update to 1.13.4
CVE-2024-2092
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.3Update to 1.13.4
CVE-2024-3743
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.1Update to 1.13.2
CVE-2024-30422
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.2Update to 1.13.3
CVE-2024-2091
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget
≤1.13.2Update to 1.13.3
CVE-2024-2792
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.12.10Update to 1.12.11
CVE-2024-29107
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet
≤1.12.12Update to 1.13
CVE-2024-1422
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget
≤1.12.12Update to 1.13
CVE-2024-1392
High8.8Directory Traversal to Local File Inclusion
≤1.12.12Update to 1.13
CVE-2024-1358
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget
≤1.12.12Update to 1.13
CVE-2024-1391
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget
≤1.12.12Update to 1.13
CVE-2024-1393
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
1.12.11 – 1.12.11Update to 1.12.12
CVE-2024-0834
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.12.7Update to 1.12.8
CVE-2023-5381
Medium5.4Cross-Site Request Forgery
≤1.12.7Update to 1.12.8
CVE-2023-4689
Medium5.3Missing Authorization to Sensitive Information Exposure
≤1.12.7Update to 1.12.8
CVE-2023-4723
Medium5.4Cross-Site Request Forgery
≤1.12.7Update to 1.12.8
CVE-2023-4690
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium6.3Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974
Medium6.5Cross-Site Request Forgery
≤1.11.7Update to 1.11.8
—
Medium5.4Stored Cross-Site Scripting
<1.11.2Update to 1.11.2
CVE-2021-24259
Medium6.1Reflected Cross-Site Scripting
<1.6.4Update to 1.6.4
—

Addon Elements for Elementor (formerly Elementor Addon Elements): common questions

Does Addon Elements for Elementor (formerly Elementor Addon Elements) have known vulnerabilities?

Yes. VulnCrest Radar lists 34 known vulnerabilities in Addon Elements for Elementor (formerly Elementor Addon Elements): 1 high, 33 medium. At least one is not fixed in the latest version.

How do I check which version of Addon Elements for Elementor (formerly Elementor Addon Elements) I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Addon Elements for Elementor (formerly Elementor Addon Elements) vulnerability?

CVE-2026-125743, published Nov 11, 2026: Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Addon Elements for Elementor (formerly Elementor Addon Elements) vulnerability listed in CISA KEV?

No. None of the known Addon Elements for Elementor (formerly Elementor Addon Elements) vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?