VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates security & vulnerabilities

the-plus-addons-for-elementor-page-builder— active installsLast vulnerability Oct 29, 2026

No known unpatched vulnerabilities in the latest version

All 43 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
43Known vulnerabilities
  • Critical0
  • High1
  • Medium42
  • Low0
Vulnerabilities per year
2021: 3 vulnerabilities3212024: 24 vulnerabilities24242025: 6 vulnerabilities6252026: 10 vulnerabilities1026

All The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates vulnerabilities

The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.5.3Update to 6.6.0
CVE-2026-116848
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.5.1Update to 6.5.2
CVE-2026-96829
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
≤6.4.15Update to 6.4.16
CVE-2026-9243
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
≤6.4.11Update to 6.4.12
CVE-2026-15285
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.4.11Update to 6.4.12
—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.4.11Update to 6.4.12
—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
≤6.4.11Update to 6.4.12
CVE-2026-5243
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar
≤6.4.9Update to 6.4.10
CVE-2026-3311
Medium5.3Unauthenticated Email Relay
≤6.4.7Update to 6.4.8
CVE-2026-2385
Medium4.3Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
≤6.4.7Update to 6.4.8
CVE-2026-2386
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
≤6.3.15Update to 6.3.16
CVE-2025-9698
Medium4.3Missing Authorization
≤6.3.13Update to 6.3.14
CVE-2025-55712
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.3.10Update to 6.3.11
CVE-2025-7646
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.2.7Update to 6.2.8
CVE-2025-49076
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤6.2.2Update to 6.2.3
CVE-2025-1287
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.1.8Update to 6.2.0
CVE-2024-11829
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.14Update to 6.0.1
CVE-2024-53823
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
≤6.0.3Update to 6.0.4
CVE-2024-10365
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via content_template
≤5.6.11Update to 5.6.12
CVE-2024-8913
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤5.6.2Update to 5.6.3
CVE-2024-43977
Medium4.3Missing Authorization
≤5.6.2Update to 5.6.3
CVE-2024-43932
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings
≤5.6.2Update to 5.6.3
CVE-2024-5583
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
≤5.6.2Update to 5.6.3
CVE-2024-5763
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget
≤5.6.2Update to 5.6.3
CVE-2024-6575
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤5.6.1Update to 5.6.2
CVE-2024-4482
Medium6.4The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.6.0Update to 5.6.1
CVE-2024-4983
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.5.4Update to 5.5.5
CVE-2024-35709
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.5.2Update to 5.5.3
CVE-2024-4485
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.5.1Update to 5.5.3
CVE-2024-4484
Medium6.4Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card
≤5.5.4Update to 5.5.5
CVE-2024-2784
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box
≤5.5.4Update to 5.5.5
CVE-2024-3718
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.2Update to 5.5.0
CVE-2024-0445
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
≤5.4.2Update to 5.5.0
CVE-2024-2785
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.4.2Update to 5.5.0
CVE-2024-34373
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤5.4.2Update to 5.5.0
CVE-2024-3199
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
≤5.4.2Update to 5.5.0
CVE-2024-3197
Medium6.4Authenticated (Contributor+) Local File Inclusion via Clients Widget
≤5.4.1Update to 5.4.2
CVE-2024-2203
Medium6.4Authenticated (Contributor+) Local File Inclusion via Team Member Listing
≤5.4.1Update to 5.4.2
CVE-2024-2210
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget
≤5.4.0Update to 5.4.1
CVE-2024-1419
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.3.3Update to 5.3.4
CVE-2024-23511
High8.8Authenticated (Contributor+) Privilege Escalation
≤2.0.6Update to 2.0.7
CVE-2021-4331
Medium6.5Authenticated (Contributor+) Arbitrary File Read
≤4.1.9Update to 2.0.7 or 4.1.10
CVE-2021-4332
Medium5.4Authenticated Stored Cross-Site Scripting
<2.0.6Update to 2.0.6
CVE-2021-24266

The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates: common questions

Does The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates have known vulnerabilities?

Yes. VulnCrest Radar lists 43 known vulnerabilities in The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates: 1 high, 42 medium. None are known to affect version null.

How do I check which version of The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates vulnerability?

CVE-2026-116848, published Oct 29, 2026: The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates vulnerability listed in CISA KEV?

No. None of the known The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?