VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

PowerPack Addons for Elementor: Widgets, Form Styler and Templates security & vulnerabilities

powerpack-lite-for-elementor— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 18 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
18Known vulnerabilities
  • Critical0
  • High0
  • Medium18
  • Low0
Vulnerabilities per year
2021: 2 vulnerabilities2212024: 8 vulnerabilities8242025: 2 vulnerabilities2252026: 6 vulnerabilities626

All PowerPack Addons for Elementor: Widgets, Form Styler and Templates vulnerabilities

PowerPack Addons for Elementor: Widgets, Form Styler and Templates vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Unauthenticated Information Exposure
≤3.1.3Update to 3.1.4
CVE-2026-125435
Medium6.43.1.2 - Authenticated (Contributor+) Server-Side Request Forgery
2.10.0 – 3.1.2Update to 3.1.3
CVE-2026-110692
Medium4.3Missing Authorization
≤3.1.0Update to 3.1.1
CVE-2026-114182
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.0Update to 3.1.1
CVE-2026-111400
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.0Update to 3.1.1
CVE-2026-108488
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.9.9Update to 2.9.10
CVE-2026-32430
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'
≤2.9.4Update to 2.9.5
CVE-2025-8388
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.9.0Update to 2.9.1
CVE-2025-1512
Medium4.3Authenticated (Contributor+) Post Disclosure
≤2.8.1Update to 2.8.2
CVE-2024-10692
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget
≤2.7.20Update to 2.7.21
CVE-2024-5787
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤2.7.19Update to 2.7.20
CVE-2024-5327
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*
≤2.7.17Update to 2.7.18
CVE-2024-2491
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget
≤2.7.18Update to 2.7.19
CVE-2024-2492
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget
≤2.7.15Update to 2.7.16
CVE-2024-1411
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.14Update to 2.7.15
CVE-2024-1055
Medium5.3Cross-Site Request Forgery
≤2.7.13Update to 2.7.14
CVE-2023-6984
Medium6.1Reflected Cross-Site Scripting
≤2.6.1Update to 2.6.2
CVE-2021-25027
Medium5.4Contributor+ Stored Cross-Site Scripting
≤2.3.1Update to 2.3.2
CVE-2021-24263

PowerPack Addons for Elementor: Widgets, Form Styler and Templates: common questions

Does PowerPack Addons for Elementor: Widgets, Form Styler and Templates have known vulnerabilities?

Yes. VulnCrest Radar lists 18 known vulnerabilities in PowerPack Addons for Elementor: Widgets, Form Styler and Templates: 18 medium. None are known to affect version null.

How do I check which version of PowerPack Addons for Elementor: Widgets, Form Styler and Templates I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent PowerPack Addons for Elementor: Widgets, Form Styler and Templates vulnerability?

CVE-2026-125435, published Nov 11, 2026: PowerPack Addons for Elementor: Widgets, Form Styler and Templates <= 3.1.3 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).

Is any PowerPack Addons for Elementor: Widgets, Form Styler and Templates vulnerability listed in CISA KEV?

No. None of the known PowerPack Addons for Elementor: Widgets, Form Styler and Templates vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?