Cross-Site Scripting
28 records73.7%First: 2024. Latest: 2026.
Plugin security history
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 38 vulnerability records associated with Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons, published between 2024 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
38Total records
1Critical
0High
37Medium
0Low
0Informational
38Patched records
0Currently marked unpatched
2024-02-02First disclosure
2026-04-07Latest disclosure
38 of 38CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2024 | 26 | |
| 2025 | 8 | |
| 2026 | 4 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 2.6% |
| Medium | 37 | 97.4% |
Vulnerability-Type Breakdown
Other
3 records7.9%First: 2024. Latest: 2025.
Missing Authorization
2 records5.3%First: 2024. Latest: 2024.
SQL Injection
2 records5.3%First: 2024. Latest: 2026.
Information Disclosure
1 record2.6%First: 2024. Latest: 2024.
CSRF
1 record2.6%First: 2026. Latest: 2026.
Path Traversal
1 record2.6%First: 2026. Latest: 2026.
Patch Status
- Patched
- 38
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
8.5.08.3.188.3.148.3.58.2.68.1.68.1.05.11.35.10.305.10.295.10.155.10.135.10.65.10.35.10.25.7.65.7.35.7.75.6.125.6.65.6.25.6.45.6.15.6.05.3.35.5.45.4.12
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-8.4.2 | Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget | April 7, 2026 | 8.5.0 | Medium |
*-8.4.2 | Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection | March 23, 2026 | 8.5.0 | Medium |
*-8.3.17 | Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read | February 14, 2026 | 8.3.18 | Medium |
*-8.3.13 | Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery | January 16, 2026 | 8.3.14 | Medium |
*-8.3.4 | Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget | November 17, 2025 | 8.3.5 | Medium |
*-8.2.5 | Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | October 20, 2025 | 8.2.6 | Medium |
*-8.1.5 | Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content | August 5, 2025 | 8.1.6 | Medium |
8.0.0 | Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute | July 2, 2025 | 8.1.0 | Medium |
*-5.11.2 | Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting | May 30, 2025 | 5.11.3 | Medium |
*-5.10.29 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting | April 25, 2025 | 5.10.30 | Medium |
*-5.10.28 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting | April 18, 2025 | 5.10.29 | Medium |
*-5.10.14 | Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting | January 7, 2025 | 5.10.15 | Medium |
*-5.10.12 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization | December 21, 2024 | 5.10.13 | Medium |
*-5.10.5 | Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget | December 2, 2024 | 5.10.6 | Medium |
*-5.10.2 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent' | November 14, 2024 | 5.10.3 | Medium |
*-5.10.2 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting | November 7, 2024 | 5.10.3 | Medium |
*-5.10.2 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget | November 4, 2024 | 5.10.3 | Medium |
*-5.10.2 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting | November 4, 2024 | 5.10.3 | Medium |
*-5.10.1 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate | November 1, 2024 | 5.10.2 | Medium |
*-5.10.1 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget | November 1, 2024 | 5.10.2 | Medium |
*-5.7.5 | Element Pack Elementor Addons <= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting | September 30, 2024 | 5.7.6 | Medium |
*-5.7.2 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets | August 12, 2024 | 5.7.3 | Medium |
*-5.7.2 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read | August 8, 2024 | 5.7.3 | Medium |
*-5.7.6 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag | August 8, 2024 | 5.7.7 | Medium |
*-5.6.11 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting | August 1, 2024 | 5.6.12 | Medium |
Selected source records
Latest Records
MediumCVE-2026-4655
Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Published: April 7, 2026
- Affected versions
- *-8.4.2
- Patched versions
- 8.5.0
MediumCVE-2026-40745
Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection
Published: March 23, 2026
- Affected versions
- *-8.4.2
- Patched versions
- 8.5.0
MediumCVE-2026-1793
Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
Published: February 14, 2026
- Affected versions
- *-8.3.17
- Patched versions
- 8.3.18
MediumCVE-2025-31413
Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
Published: January 16, 2026
- Affected versions
- *-8.3.13
- Patched versions
- 8.3.14
MediumCVE-2025-13196
Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget
Published: November 17, 2025
- Affected versions
- *-8.3.4
- Patched versions
- 8.3.5
MediumCVE-2025-11536
Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
Published: October 20, 2025
- Affected versions
- *-8.2.5
- Patched versions
- 8.2.6
MediumCVE-2025-8100
Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
Published: August 5, 2025
- Affected versions
- *-8.1.5
- Patched versions
- 8.1.6
MediumCVE-2025-5944
Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
Published: July 2, 2025
- Affected versions
- 8.0.0
- Patched versions
- 8.1.0
Highest-Severity Records
CriticalCVE-2024-30496
Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) SQL Injection
Published: March 28, 2024
- Affected versions
- *-5.5.3
- Patched versions
- 5.5.4
MediumCVE-2026-1793
Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
Published: February 14, 2026
- Affected versions
- *-8.3.17
- Patched versions
- 8.3.18
MediumCVE-2024-9657
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published: November 4, 2024
- Affected versions
- *-5.10.2
- Patched versions
- 5.10.3
MediumCVE-2024-4359
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
Published: August 8, 2024
- Affected versions
- *-5.7.2
- Patched versions
- 5.7.3
MediumCVE-2026-4655
Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Published: April 7, 2026
- Affected versions
- *-8.4.2
- Patched versions
- 8.5.0
MediumCVE-2024-4643
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: August 1, 2024
- Affected versions
- *-5.6.11
- Patched versions
- 5.6.12
MediumCVE-2024-10310
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget
Published: November 1, 2024
- Affected versions
- *-5.10.1
- Patched versions
- 5.10.2
MediumCVE-2024-3925
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events
Published: June 11, 2024
- Affected versions
- *-5.6.11
- Patched versions
- 5.6.12
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.