Plugin security history

DethemeKit for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 13 vulnerability records associated with DethemeKit for Elementor, published between 2021 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

13Total records

0Critical

0High

13Medium

0Low

0Informational

11Patched records

2Currently marked unpatched

2021-04-13First disclosure

2025-09-22Latest disclosure

13 of 13CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2024	6	6 records
2025	6	6 records

Severity Breakdown

Severity	Records	Share
Medium	13	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

10 records76.9%

First: 2021. Latest: 2025.

Missing Authorization

3 records23.1%

First: 2025. Latest: 2025.

Patch Status

Patched: 11
Currently marked unpatched: 2
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.1.10
2.1.9
2.1.8
2.1.6
2.1.5
2.1.4
2.1.3
2.1.0
1.5.5.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.1.10`	DethemeKit For Elementor <= 2.1.10 - Missing Authorization	September 22, 2025	Not supplied	Medium
`*-2.1.10`	DethemeKit For Elementor <= 2.1.10 - Missing Authorization	April 4, 2025	Not supplied	Medium
`*-2.1.9`	DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 13, 2025	2.1.10	Medium
`*-2.1.8`	DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 14, 2025	2.1.9	Medium
`*-2.1.8`	DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget	February 12, 2025	2.1.9	Medium
`*-2.1.8`	DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure	February 12, 2025	2.1.9	Medium
`*-2.1.7`	DethemeKit For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 30, 2024	2.1.8	Medium
`*-2.1.5`	DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget	June 26, 2024	2.1.6	Medium
`*-2.1.4`	DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute	May 30, 2024	2.1.5	Medium
`*-2.1.3`	DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 17, 2024	2.1.4	Medium
`*-2.1.2`	DethemeKit For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 14, 2024	2.1.3	Medium
`*-2.0.2`	DethemeKit For Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 15, 2024	2.1.0	Medium
`[*, 1.5.5.5)`	DethemeKit For Elementor <= 1.5.5.4 - Authenticated Stored Cross-Site Scripting	April 13, 2021	1.5.5.5	Medium

Selected source records

Latest Records

MediumCVE-2025-57995

DethemeKit For Elementor <= 2.1.10 - Missing Authorization

Published: September 22, 2025

Affected versions: *-2.1.10
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-32260

DethemeKit For Elementor <= 2.1.10 - Missing Authorization

Published: April 4, 2025

Affected versions: *-2.1.10
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-1526

DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 13, 2025

Affected versions: *-2.1.9
Patched versions: 2.1.10

Original Wordfence record

MediumCVE-2025-26772

DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 14, 2025

Affected versions: *-2.1.8
Patched versions: 2.1.9

Original Wordfence record

MediumCVE-2025-0661

DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure

Published: February 12, 2025

Affected versions: *-2.1.8
Patched versions: 2.1.9

Original Wordfence record

MediumCVE-2024-13644

DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget

Published: February 12, 2025

Affected versions: *-2.1.8
Patched versions: 2.1.9

Original Wordfence record

MediumCVE-2024-47632

DethemeKit For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 30, 2024

Affected versions: *-2.1.7
Patched versions: 2.1.8

Original Wordfence record

MediumCVE-2024-6283

DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget

Published: June 26, 2024

Affected versions: *-2.1.5
Patched versions: 2.1.6

Original Wordfence record

Highest-Severity Records

MediumCVE-2024-34575

DethemeKit For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 14, 2024

Affected versions: *-2.1.2
Patched versions: 2.1.3

Original Wordfence record

MediumCVE-2024-5418

DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute

Published: May 30, 2024

Affected versions: *-2.1.4
Patched versions: 2.1.5

Original Wordfence record

MediumCVE-2024-32508

DethemeKit For Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 15, 2024

Affected versions: *-2.0.2
Patched versions: 2.1.0

Original Wordfence record

MediumCVE-2025-26772

DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 14, 2025

Affected versions: *-2.1.8
Patched versions: 2.1.9

Original Wordfence record

MediumCVE-2024-13644

DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget

Published: February 12, 2025

Affected versions: *-2.1.8
Patched versions: 2.1.9

Original Wordfence record

MediumCVE-2025-1526

DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 13, 2025

Affected versions: *-2.1.9
Patched versions: 2.1.10

Original Wordfence record

MediumCVE-2024-47632

DethemeKit For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 30, 2024

Affected versions: *-2.1.7
Patched versions: 2.1.8

Original Wordfence record

MediumCVE-2024-4374

DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published: May 17, 2024

Affected versions: *-2.1.3
Patched versions: 2.1.4

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-57995

DethemeKit For Elementor <= 2.1.10 - Missing Authorization

Published: September 22, 2025

Affected versions: *-2.1.10
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-32260

DethemeKit For Elementor <= 2.1.10 - Missing Authorization

Published: April 4, 2025

Affected versions: *-2.1.10
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory