VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Essential Addons for Elementor – Popular Elementor Templates & Widgets security & vulnerabilities

essential-addons-for-elementor-lite— active installsLast vulnerability Oct 30, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
76Known vulnerabilities
  • Critical2
  • High9
  • Medium64
  • Low1
Vulnerabilities per year
2021: 3 vulnerabilities3212022: 2 vulnerabilities2222023: 3 vulnerabilities3232024: 35 vulnerabilities35242025: 11 vulnerabilities11252026: 22 vulnerabilities2226

All Essential Addons for Elementor – Popular Elementor Templates & Widgets vulnerabilities

Essential Addons for Elementor – Popular Elementor Templates & Widgets vulnerabilities
SeverityVulnerabilityCVEPublished
High7.4Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
≤6.8.7Update to 6.8.8
CVE-2026-118205
Medium6.36.8.7 - Authenticated (Author+) Privilege Escalation
6.6.0 – 6.8.7Update to 6.8.8
CVE-2026-110808
Medium5.3Unauthenticated Information Exposure
<6.8.7Update to 6.8.7
CVE-2026-110509
High7.36.8.6 - Unauthenticated Registration Approval Bypass
6.7.3 – 6.8.6Update to 6.8.7
CVE-2026-110508
Low2.7Missing Authorization
<6.8.7Update to 6.8.7
CVE-2026-110537
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
<6.8.7Update to 6.8.7
CVE-2026-110510
Medium6.3Authenticated (Author+) Privilege Escalation
≤6.8.5Update to 6.8.6
CVE-2026-110898
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.8.4Update to 6.8.5
CVE-2026-102394
Medium5.3Unauthenticated Captcha Bypass
≤6.8.0Update to 6.8.1
CVE-2026-81777
High7.3Unauthenticated Privilege Escalation
≤6.7.1Update to 6.7.2
CVE-2026-18039
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<6.6.10Update to 6.6.10
CVE-2026-13344
Medium5.3Missing Authorization
<6.6.10Update to 6.6.10
CVE-2026-13345
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
≤6.6.11Update to 6.7.0
CVE-2026-15145
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
≤6.6.11Update to 6.7.0
CVE-2026-15156
High8.8Authenticated (Contributor+) Account Takeover via Email Header Injection
≤6.6.10Update to 6.6.11
CVE-2026-15155
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
≤6.6.2Update to 6.6.3
CVE-2026-6459
Medium5.3Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
≤6.6.4Update to 6.6.5
CVE-2026-7665
Medium6.5Authenticated (Author+) Limited Privilege Escalation via register_user
≤6.5.13Update to 6.6.0
CVE-2026-5193
Medium5.3Missing Authorization
<6.6.0Update to 6.6.0
CVE-2026-25440
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
≤6.5.9Update to 6.5.10
CVE-2026-1512
Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure
≤6.5.5Update to 6.5.6
CVE-2026-1004
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.5.3Update to 6.5.4
CVE-2025-69092
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.5.3Update to 6.5.4
CVE-2025-13977
Medium5.3Missing Authorization
≤6.5.5Update to 6.5.6
CVE-2026-23543
Medium4.3Missing Authorization
≤6.2.4Update to 6.3.0
CVE-2025-64352
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'
≤6.2.2Update to 6.2.3
CVE-2025-8451
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets
≤6.1.19Update to 6.1.20
CVE-2025-6244
Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
≤6.0.4Update to 6.0.5
CVE-2024-5647
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
≤6.1.12Update to 6.1.13
CVE-2024-9993
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
≤6.1.12Update to 6.1.13
CVE-2024-9994
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.1.9Update to 6.1.10
CVE-2025-39590
Medium4.3Authenticated (Contributor+) Information Disclosure
≤6.1.9Update to 6.1.10
CVE-2025-39589
Medium6.1Reflected Cross-Site Scripting
≤6.0.14Update to 6.0.15
CVE-2025-24752
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.0.7Update to 6.0.8
CVE-2024-56063
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.0.7Update to 6.0.8
CVE-2024-8961
High8.0Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation
≤6.0.9Update to 6.0.10
CVE-2024-8979
Medium5.7Authenticated (Contributor+) Sensitive Information Exposure
≤6.0.9Update to 6.0.10
CVE-2024-8978
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget
≤6.0.3Update to 6.0.4
CVE-2024-8742
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
≤6.0.3Update to 6.0.4
CVE-2024-8440
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter
≤5.9.27Update to 6.0.0
CVE-2024-7092
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.26Update to 5.9.27
CVE-2024-39649
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.23Update to 5.9.24
CVE-2024-5189
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.22Update to 5.9.23
CVE-2024-5188
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed
≤5.9.21Update to 5.9.22
CVE-2024-5073
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.15Update to 5.9.16
CVE-2024-34764
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.20Update to 5.9.21
CVE-2024-4624
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'
≤5.9.19Update to 5.9.20
CVE-2024-4448
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'
≤5.9.19Update to 5.9.20
CVE-2024-4275
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets
≤5.9.19Update to 5.9.20
CVE-2024-4449
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.17Update to 5.9.18
CVE-2024-4156
Medium5.3Information Exposure
≤5.9.15Update to 5.9.16
CVE-2024-3733
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.15Update to 5.9.16
CVE-2024-4003
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle
≤5.9.15Update to 5.9.16
CVE-2024-3728
Medium6.4Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute
≤5.9.14Update to 5.9.15
CVE-2024-3333
Medium5.3Unauthenticated Sensitive Information Exposure
≤5.9.13Update to 5.9.14
CVE-2024-2974
High8.8Authenticated (Author+) PHP Object Injection via error_resetpassword
≤5.9.13Update to 5.9.14
CVE-2024-3018
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.11Update to 5.9.12
CVE-2024-2650
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.11Update to 5.9.12
CVE-2024-2623
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table
≤5.9.9Update to 5.9.10
CVE-2024-1537
High7.4Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar
≤5.9.9Update to 5.9.10
CVE-2024-1536
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion
≤5.9.8Update to 5.9.9
CVE-2024-1172
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery
≤5.9.8Update to 5.9.9
CVE-2024-1171
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.8Update to 5.9.9
CVE-2024-1276
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.8Update to 5.9.9
CVE-2024-1236
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.7Update to 5.9.8
CVE-2024-0954
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl
≤5.9.4Update to 5.9.5
CVE-2024-0585
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scritping
≤5.9.4Update to 5.9.5
CVE-2024-0586
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.9.2Update to 5.9.3
CVE-2023-7044
High8.8Authenticated (Contributor+) Privilege Escalation
≤5.8.8Update to 5.8.9
CVE-2023-41955
Medium5.3Unauthenticated MailChimp API Key Disclosure
≤5.8.1Update to 5.8.2
CVE-2023-3779
Critical9.8Unauthenticated Arbitrary Password Reset to Privilege Escalation
≤5.7.1Update to 5.7.2
CVE-2023-32243
Medium6.1Reflected Cross-Site Scripting
≤5.0.8Update to 5.0.9
CVE-2022-0683
Critical9.8Local File Inclusion
1.0.0 – 5.0.4Update to 5.0.5
CVE-2022-0320
High8.8Authenticated (Contributor+) Privilege Escalation
≤4.6.4Update to 4.6.5
CVE-2021-4447
Medium6.3Missing Authorization
≤4.6.4Update to 4.6.5
CVE-2021-4446
Medium5.4Cross-Site Scripting
<4.5.4Update to 4.5.4
CVE-2021-24255

Essential Addons for Elementor – Popular Elementor Templates & Widgets: common questions

Does Essential Addons for Elementor – Popular Elementor Templates & Widgets have known vulnerabilities?

Yes. VulnCrest Radar lists 76 known vulnerabilities in Essential Addons for Elementor – Popular Elementor Templates & Widgets: 2 critical, 9 high, 64 medium, 1 low. At least one is not fixed in the latest version.

How do I check which version of Essential Addons for Elementor – Popular Elementor Templates & Widgets I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Essential Addons for Elementor – Popular Elementor Templates & Widgets vulnerability?

CVE-2026-118205, published Oct 30, 2026: Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision. Severity: High (CVSS 7.4).

Is any Essential Addons for Elementor – Popular Elementor Templates & Widgets vulnerability listed in CISA KEV?

No. None of the known Essential Addons for Elementor – Popular Elementor Templates & Widgets vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?