VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons security & vulnerabilities

bdthemes-element-pack-lite— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 49 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
49Known vulnerabilities
  • Critical1
  • High0
  • Medium48
  • Low0
Vulnerabilities per year
2024: 26 vulnerabilities26242025: 8 vulnerabilities8252026: 15 vulnerabilities1526

All Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons vulnerabilities

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤10.0.3Update to 10.0.4
CVE-2026-124752
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤10.0.4Update to 10.0.5
CVE-2026-125708
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤10.0.2Update to 10.0.3
CVE-2026-119501
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.8.8Update to 8.8.9
CVE-2026-108478
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.8.6Update to 8.8.7
CVE-2026-105873
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.8.6Update to 8.8.7
CVE-2026-105871
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.8.3Update to 8.8.4
CVE-2026-66574
Medium5.4Cross-Site Scripting via display_id from Sigmative API
≤4.4.5Update to 4.4.6
CVE-2026-92991
Medium5.3Unauthenticated SMTP Header Injection
≤8.3.15Update to 8.3.16
CVE-2026-0673
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<8.7.13Update to 8.7.13
CVE-2026-14817
Medium5.3Missing Authorization
≤8.7.13Update to 8.7.14
CVE-2026-65502
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
≤8.4.2Update to 8.5.0
CVE-2026-4655
Medium4.9Authenticated (Editor+) SQL Injection
≤8.4.2Update to 8.5.0
CVE-2026-40745
Medium6.5Authenticated (Contributor+) Arbitrary File Read
≤8.3.17Update to 8.3.18
CVE-2026-1793
Medium4.3Cross-Site Request Forgery
≤8.3.13Update to 8.3.14
CVE-2025-31413
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget
≤8.3.4Update to 8.3.5
CVE-2025-13196
Medium5.0Authenticated (Subscriber+) Blind Server-Side Request Forgery
≤8.2.5Update to 8.2.6
CVE-2025-11536
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
≤8.1.5Update to 8.1.6
CVE-2025-8100
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
8.0.0 – 8.0.0Update to 8.1.0
CVE-2025-5944
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤5.11.2Update to 5.11.3
CVE-2025-5292
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.10.29Update to 5.10.30
CVE-2025-1458
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤5.10.28Update to 5.10.29
CVE-2025-1457
Medium6.4Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.10.14Update to 5.10.15
CVE-2024-12851
Medium4.3Missing Authorization
≤5.10.12Update to 5.10.13
CVE-2024-11852
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget
≤5.10.5Update to 5.10.6
CVE-2024-9058
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent'
≤5.10.2Update to 5.10.3
CVE-2024-10980
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.10.2Update to 5.10.3
CVE-2024-10493
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget
≤5.10.2Update to 5.10.3
CVE-2024-9867
Medium6.5Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤5.10.2Update to 5.10.3
CVE-2024-9657
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
≤5.10.1Update to 5.10.2
CVE-2024-9868
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget
≤5.10.1Update to 5.10.2
CVE-2024-10310
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.7.5Update to 5.7.6
CVE-2024-47392
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets
≤5.7.2Update to 5.7.3
CVE-2024-7247
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag
≤5.7.6Update to 5.7.7
CVE-2024-4360
Medium6.5Authenticated (Contributor+) Arbitrary File Read
≤5.7.2Update to 5.7.3
CVE-2024-4359
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.11Update to 5.6.12
CVE-2024-4643
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.5Update to 5.6.6
CVE-2024-5555
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.11Update to 5.6.12
CVE-2024-5554
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events
≤5.6.11Update to 5.6.12
CVE-2024-3925
Medium5.3Form Submission Admin Email Bypass
≤5.6.3Update to 5.6.4
CVE-2024-3927
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes
≤5.6.1Update to 5.6.2
CVE-2024-3926
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget
≤5.6.0Update to 5.6.1
CVE-2024-1429
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget
≤5.6.0Update to 5.6.1
CVE-2024-1426
Medium5.3Sensitive Information Exposure via element_pack_ajax_search
≤5.5.6Update to 5.6.0
CVE-2024-2966
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget
≤5.5.3Update to 5.5.4
CVE-2024-1428
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget
≤5.3.2Update to 5.3.3
CVE-2024-0837
Critical9.9Authenticated (Contributor+) SQL Injection
≤5.5.3Update to 5.5.4
CVE-2024-30496
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via link
≤5.5.3Update to 5.5.4
CVE-2024-30185
Medium4.3Missing Authorization via bdt_duplicate_as_draft
≤5.4.11Update to 5.4.12
CVE-2024-24840

Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons: common questions

Does Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons have known vulnerabilities?

Yes. VulnCrest Radar lists 49 known vulnerabilities in Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons: 1 critical, 48 medium. None are known to affect version null.

How do I check which version of Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons vulnerability?

CVE-2026-124752, published Nov 11, 2026: Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons vulnerability listed in CISA KEV?

No. None of the known Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?