Plugin security history

Addon Elements for Elementor (formerly Elementor Addon Elements) Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Addon Elements for Elementor (formerly Elementor Addon Elements), published between 2020 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records

0Critical

1High

30Medium

0Low

0Informational

31Patched records

0Currently marked unpatched

2020-09-08First disclosure

2025-12-13Latest disclosure

29 of 31CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	1	1 records
2021	2	2 records
2022	1	1 records
2023	5	5 records
2024	19	19 records
2025	3	3 records

Severity Breakdown

Severity	Records	Share
High	1	3.2%
Medium	30	96.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

21 records67.7%

First: 2020. Latest: 2025.

CSRF

3 records9.7%

First: 2021. Latest: 2023.

Missing Authorization

3 records9.7%

First: 2022. Latest: 2024.

Information Disclosure

3 records9.7%

First: 2024. Latest: 2025.

Path Traversal

1 record3.2%

First: 2024. Latest: 2024.

Patch Status

Patched: 31
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.14.4
1.14.5
1.14
1.13.9
1.13.7
1.13.6
1.13.4
1.13.2
1.13.3
1.12.11
1.13
1.12.12
1.12.8
1.12
1.11.14
1.11.8
1.11.2
1.6.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.14.3`	Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 13, 2025	1.14.4	Medium
`*-1.14.4`	Elementor Addon Elements <= 1.14.4 - Authenticated (Contributor+) Information Exposure	August 28, 2025	1.14.5	Medium
`*-1.13.10`	Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup	January 14, 2025	1.14	Medium
`*-1.13.8`	Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections	October 11, 2024	1.13.9	Medium
`*-1.13.6`	Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 30, 2024	1.13.7	Medium
`*-1.13.6`	Elementor Addon Elements <= 1.13.6 - Missing Authorization	September 30, 2024	1.13.7	Medium
`*-1.13.6`	Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	August 29, 2024	1.13.7	Medium
`*-1.13.5`	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters	August 29, 2024	1.13.6	Medium
`*-1.13.5`	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 26, 2024	1.13.6	Medium
`*-1.13.5`	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 26, 2024	1.13.6	Medium
`*-1.13.3`	Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget	June 11, 2024	1.13.4	Medium
`*-1.13.3`	Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 29, 2024	1.13.4	Medium
`*-1.13.1`	Elementor Addon Elements <= 1.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 28, 2024	1.13.2	Medium
`*-1.13.2`	Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget	March 27, 2024	1.13.3	Medium
`*-1.13.2`	Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 27, 2024	1.13.3	Medium
`*-1.12.10`	Elementor Addon Elements <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 15, 2024	1.12.11	Medium
`*-1.12.12`	Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget	February 21, 2024	1.13	Medium
`*-1.12.12`	Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget	February 21, 2024	1.13	Medium
`*-1.12.12`	Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet	February 21, 2024	1.13	Medium
`*-1.12.12`	Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget	February 21, 2024	1.13	Medium
`*-1.12.12`	Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion	February 21, 2024	1.13	High
`1.12.11`	Elementor Addon Elements <= 1.12.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 5, 2024	1.12.12	Medium
`*-1.12.7`	Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery	November 15, 2023	1.12.8	Medium
`*-1.12.7`	Elementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	November 15, 2023	1.12.8	Medium
`*-1.12.7`	Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure	November 15, 2023	1.12.8	Medium

Selected source records

Latest Records

MediumCVE-2025-12537

Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 13, 2025

Affected versions: *-1.14.3
Patched versions: 1.14.4

Original Wordfence record

MediumCVE-2026-28131

Elementor Addon Elements <= 1.14.4 - Authenticated (Contributor+) Information Exposure

Published: August 28, 2025

Affected versions: *-1.14.4
Patched versions: 1.14.5

Original Wordfence record

MediumCVE-2024-13215

Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup

Published: January 14, 2025

Affected versions: *-1.13.10
Patched versions: 1.14

Original Wordfence record

MediumCVE-2024-8902

Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections

Published: October 11, 2024

Affected versions: *-1.13.8
Patched versions: 1.13.9

Original Wordfence record

MediumCVE-2024-47361

Elementor Addon Elements <= 1.13.6 - Missing Authorization

Published: September 30, 2024

Affected versions: *-1.13.6
Patched versions: 1.13.7

Original Wordfence record

MediumCVE-2024-47366

Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 30, 2024

Affected versions: *-1.13.6
Patched versions: 1.13.7

Original Wordfence record

MediumCVE-2024-7122

Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published: August 29, 2024

Affected versions: *-1.13.6
Patched versions: 1.13.7

Original Wordfence record

MediumCVE-2024-4401

Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters

Published: August 29, 2024

Affected versions: *-1.13.5
Patched versions: 1.13.6

Original Wordfence record

Highest-Severity Records

HighCVE-2024-1358

Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion

Published: February 21, 2024

Affected versions: *-1.12.12
Patched versions: 1.13

Original Wordfence record

Medium

Elementor Addon Elements <= 1.11.7 - Cross-Site Request Forgery

Published: July 20, 2021

Affected versions: *-1.11.7
Patched versions: 1.11.8

Original Wordfence record

MediumCVE-2024-1392

Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget

Published: February 21, 2024

Affected versions: *-1.12.12
Patched versions: 1.13

Original Wordfence record

MediumCVE-2024-1422

Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet

Published: February 21, 2024

Affected versions: *-1.12.12
Patched versions: 1.13

Original Wordfence record

MediumCVE-2024-4569

Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 26, 2024

Affected versions: *-1.13.5
Patched versions: 1.13.6

Original Wordfence record

MediumCVE-2024-7122

Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published: August 29, 2024

Affected versions: *-1.13.6
Patched versions: 1.13.7

Original Wordfence record

MediumCVE-2024-0834

Elementor Addon Elements <= 1.12.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 5, 2024

Affected versions: 1.12.11
Patched versions: 1.12.12

Original Wordfence record

MediumCVE-2024-29107

Elementor Addon Elements <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 15, 2024

Affected versions: *-1.12.10
Patched versions: 1.12.11

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory