VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor security & vulnerabilities

elementskit-lite— active installsLast vulnerability Oct 1, 2026

No known unpatched vulnerabilities in the latest version

All 31 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
31Known vulnerabilities
  • Critical0
  • High3
  • Medium28
  • Low0
Vulnerabilities per year
2021: 1 vulnerability1212023: 1 vulnerability1232024: 14 vulnerabilities14242025: 5 vulnerabilities5252026: 10 vulnerabilities1026

All ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerabilities

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.0.6Update to 4.0.7
CVE-2026-103063
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.0.6Update to 4.0.7
CVE-2026-103064
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.0.5Update to 4.0.6
CVE-2026-94500
High7.2Authenticated (Admin+) Remote Code Execution
<3.10.01Update to 3.10.01
CVE-2026-13392
Medium6.4Authenticated (Subsite administrator+) Stored Cross-Site Scripting
≤3.10.0Update to 3.10.01
CVE-2026-13393
Medium5.3Missing Authorization
≤3.9.6Update to 3.9.7
CVE-2026-49053
Medium4.3Missing Authorization
≤3.9.6Update to 3.9.7
CVE-2026-49052
Medium6.5Missing Authorization to Unauthenticated Widget Content Overwrite
≤3.8.2Update to 3.9.0
CVE-2026-4362
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
≤3.7.9Update to 3.8.0
CVE-2026-2600
Medium5.3Missing Authorization
<3.7.9Update to 3.7.9
CVE-2026-23693
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget
≤3.5.2Update to 3.5.3
CVE-2025-3614
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
≤3.5.2Update to 3.5.3
CVE-2025-4479
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.4.7Update to 3.4.8
CVE-2024-11180
Medium5.3Unauthenticated Information Exposure via get_megamenu_content Function
≤3.4.0Update to 3.4.1
CVE-2025-0968
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
≤3.4.0Update to 3.4.1
CVE-2025-1005
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
≤3.2.9Update to 3.3.0
CVE-2024-10091
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
≤3.2.7Update to 3.2.8
CVE-2024-8546
Medium5.3Unauthenticated Information Exposure via ekit_widgetarea_content Function
≤3.2.0Update to 3.2.1
CVE-2024-6455
Medium5.3Missing Authorization
≤3.1.4Update to 3.2.0
CVE-2024-37255
Medium6.43.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
3.0.7 – 3.1.2Update to 3.1.3
CVE-2024-3650
High8.8Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module
≤3.1.0Update to 3.1.1
CVE-2024-3499
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.0.6Update to 3.0.7
CVE-2024-32505
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤3.0.7Update to 3.1.0
CVE-2024-2803
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.0.6Update to 3.0.7
CVE-2024-1238
High8.8Authenticated (Contributor+) Local File Inclusion in render_raw
≤3.0.6Update to 3.0.7
CVE-2024-2047
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
≤3.0.5Update to 3.0.6
CVE-2024-2042
Medium5.5Authenticated(Editor+) Stored Cross-Site Scripting
≤3.0.3Update to 3.0.4
CVE-2023-6525
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.0.4Update to 3.0.5
CVE-2024-1239
Medium5.3Unauthenticated Sensitive Information Exposure
≤3.0.3Update to 3.0.4
CVE-2023-6582
Medium5.4Missing Authorization
≤2.9.1Update to 2.9.2
CVE-2023-39993
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.1.7Update to 2.2.0
CVE-2021-24258

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor: common questions

Does ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor: 3 high, 28 medium. None are known to affect version null.

How do I check which version of ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerability?

CVE-2026-103063, published Oct 1, 2026: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerability listed in CISA KEV?

No. None of the known ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?