VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Exclusive Addons for Elementor security & vulnerabilities

exclusive-addons-for-elementor— active installsLast vulnerability Aug 1, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
31Known vulnerabilities
  • Critical0
  • High0
  • Medium31
  • Low0
Vulnerabilities per year
2022: 2 vulnerabilities2222023: 1 vulnerability1232024: 19 vulnerabilities19242025: 4 vulnerabilities4252026: 5 vulnerabilities526

All Exclusive Addons for Elementor vulnerabilities

Exclusive Addons for Elementor vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
≤2.7.9.8Update to 2.7.9.9
CVE-2026-12231
Medium5.3Unauthenticated Information Exposure
≤2.8.0Update to 2.8.1
CVE-2026-66438
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
≤2.7.9.8Update to 2.7.9.9
CVE-2026-11328
Medium5.3Unauthenticated Information Exposure
≤2.7.9.9Update to 2.8.0
CVE-2026-59511
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.9.8Update to 2.7.9.9
CVE-2026-57620
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
≤2.7.9.4Update to 2.7.9.5
CVE-2025-7498
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
≤2.7.9.1Update to 2.7.9.2
CVE-2025-4783
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.7.9Update to 2.7.9.1
CVE-2025-48244
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets
≤2.7.6Update to 2.7.7
CVE-2025-1571
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
≤2.7.4Update to 2.7.5
CVE-2024-10312
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.1Update to 2.7.2
CVE-2024-49292
Medium6.4Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget
≤2.6.9.8Update to 2.6.9.9
CVE-2024-5332
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
≤2.6.9.6Update to 2.6.9.7
CVE-2024-4618
Medium5.4Missing Authorization to Post Duplication
≤2.6.9.1Update to 2.6.9.2
CVE-2024-33914
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title
≤2.6.9.4Update to 2.6.9.5
CVE-2024-3489
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action
≤2.6.9.4Update to 2.6.9.5
CVE-2024-3985
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
≤2.6.9.3Update to 2.6.9.4
CVE-2024-2750
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox
≤2.6.9.2Update to 2.6.9.3
CVE-2024-2751
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid
≤2.6.9.2Update to 2.6.9.3
CVE-2024-2503
Medium4.3Missing Authorization via handle_optin_optout
≤4.1.2Update to 4.1.3
CVE-2024-32110
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.6.9Update to 2.6.9.1
CVE-2024-30232
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.6.8Update to 2.6.9
CVE-2024-30177
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
≤2.6.9Update to 2.6.9.1
CVE-2024-1413
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
≤2.6.9Update to 2.6.9.1
CVE-2024-1414
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget
≤2.6.9Update to 2.6.9.1
CVE-2024-2028
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.6.9Update to 2.6.9.1
CVE-2024-1234
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything
≤2.6.8Update to 2.6.9
CVE-2024-0824
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.6.8Update to 2.6.9
CVE-2024-0823
Medium4.3Cross-Site Request Forgery
≤2.6.1Update to 2.6.2
CVE-2022-45067
Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
—
Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
CVE-2022-47150

Exclusive Addons for Elementor: common questions

Does Exclusive Addons for Elementor have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in Exclusive Addons for Elementor: 31 medium. At least one is not fixed in the latest version.

How do I check which version of Exclusive Addons for Elementor I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Exclusive Addons for Elementor vulnerability?

CVE-2026-12231, published Aug 1, 2026: Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'. Severity: Medium (CVSS 6.4).

Is any Exclusive Addons for Elementor vulnerability listed in CISA KEV?

No. None of the known Exclusive Addons for Elementor vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?