Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Essential Addons for Elementor – Popular Elementor Templates & Widgets Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 64 vulnerability records associated with Essential Addons for Elementor – Popular Elementor Templates & Widgets, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

64Total records
2Critical
6High
56Medium
0Low
0Informational
64Patched records
0Currently marked unpatched
2021-04-13First disclosure
2026-07-20Latest disclosure
64 of 64CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
202133 records
202222 records
202333 records
20243535 records
20251111 records
20261010 records

Severity Breakdown

SeverityRecordsShare
Critical23.1%
High69.4%
Medium5687.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

45 records70.3%

First: 2021. Latest: 2026.

Missing Authorization

8 records12.5%

First: 2021. Latest: 2026.

Information Disclosure

6 records9.4%

First: 2023. Latest: 2025.

Other

3 records4.7%

First: 2022. Latest: 2026.

Privilege Escalation

2 records3.1%

First: 2023. Latest: 2026.

Patch Status

Patched
64
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 6.7.0
  • 6.6.11
  • 6.6.3
  • 6.6.5
  • 6.6.0
  • 6.5.10
  • 6.5.4
  • 6.5.6
  • 6.3.0
  • 6.2.3
  • 6.1.20
  • 6.0.5
  • 6.1.13
  • 6.1.10
  • 6.0.15
  • 6.0.8
  • 6.0.10
  • 6.0.4
  • 6.0.0
  • 5.9.27
  • 5.9.24
  • 5.9.23
  • 5.9.22
  • 5.9.21
  • 5.9.20
  • 5.9.18
  • 5.9.16
  • 5.9.15
  • 5.9.14
  • 5.9.12
  • 5.9.10
  • 5.9.9
  • 5.9.8
  • 5.9.5
  • 5.9.3
  • 5.8.9
  • 5.8.2
  • 5.7.2
  • 5.0.9
  • 5.0.5
  • 4.6.5
  • 4.5.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-6.6.11Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text WidgetJuly 20, 20266.7.0Medium
*-6.6.11Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color SettingsJuly 20, 20266.7.0Medium
*-6.6.10Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header InjectionJuly 10, 20266.6.11High
*-6.6.2Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget PopupJuly 7, 20266.6.3Medium
*-6.6.4Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX HandlerJune 5, 20266.6.5Medium
*-6.5.13Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_userMay 13, 20266.6.0Medium
[*, 6.6.0)Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing AuthorizationApril 22, 20266.6.0Medium
*-6.5.9Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box WidgetFebruary 13, 20266.5.10Medium
*-6.5.5Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information ExposureJanuary 15, 20266.5.6Medium
*-6.5.3Essential Addons for Elementor <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingJanuary 6, 20266.5.4Medium
*-6.5.3Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingDecember 16, 20256.5.4Medium
*-6.5.5Essential Addons for Elementor <= 6.5.5 - Missing AuthorizationNovember 18, 20256.5.6Medium
*-6.2.4Essential Addons for Elementor <= 6.2.4 - Missing AuthorizationSeptember 17, 20256.3.0Medium
*-6.2.2Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'August 14, 20256.2.3Medium
*-6.1.19Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` WidgetsJuly 7, 20256.1.20Medium
*-6.0.4Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript LibraryJuly 2, 20256.0.5Medium
*-6.1.12Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar WidgetJune 6, 20256.1.13Medium
*-6.1.12Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table WidgetJune 6, 20256.1.13Medium
*-6.1.9Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingApril 16, 20256.1.10Medium
*-6.1.9Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Information DisclosureApril 16, 20256.1.10Medium
*-6.0.14Essential Addons for Elementor <= 6.0.14 - Reflected Cross-Site ScriptingFebruary 4, 20256.0.15Medium
*-6.0.7Essential Addons for Elementor <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingDecember 18, 20246.0.8Medium
*-6.0.7Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingNovember 14, 20246.0.8Medium
*-6.0.9Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information ExposureNovember 14, 20246.0.10Medium
*-6.0.9Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege EscalationNovember 14, 20246.0.10High

Selected source records

Latest Records

MediumCVE-2026-15145

Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget

Published: July 20, 2026

Affected versions
*-6.6.11
Patched versions
6.7.0
Original Wordfence record
MediumCVE-2026-15156

Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings

Published: July 20, 2026

Affected versions
*-6.6.11
Patched versions
6.7.0
Original Wordfence record
HighCVE-2026-15155

Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection

Published: July 10, 2026

Affected versions
*-6.6.10
Patched versions
6.6.11
Original Wordfence record
MediumCVE-2026-6459

Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup

Published: July 7, 2026

Affected versions
*-6.6.2
Patched versions
6.6.3
Original Wordfence record
MediumCVE-2026-7665

Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

Published: June 5, 2026

Affected versions
*-6.6.4
Patched versions
6.6.5
Original Wordfence record
MediumCVE-2026-5193

Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user

Published: May 13, 2026

Affected versions
*-6.5.13
Patched versions
6.6.0
Original Wordfence record
MediumCVE-2026-25440

Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization

Published: April 22, 2026

Affected versions
[*, 6.6.0)
Patched versions
6.6.0
Original Wordfence record
MediumCVE-2026-1512

Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget

Published: February 13, 2026

Affected versions
*-6.5.9
Patched versions
6.5.10
Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-0320

Essential Addons for Elementor <= 5.0.4 - Local File Inclusion

Published: January 21, 2022

Affected versions
1.0.0-5.0.4
Patched versions
5.0.5
Original Wordfence record
CriticalCVE-2023-32243

Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation

Published: May 11, 2023

Affected versions
*-5.7.1
Patched versions
5.7.2
Original Wordfence record
HighCVE-2024-3018

Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword

Published: March 29, 2024

Affected versions
*-5.9.13
Patched versions
5.9.14
Original Wordfence record
HighCVE-2023-41955

Essential Addons for Elementor <= 5.8.8 - Authenticated (Contributor+) Privilege Escalation

Published: September 14, 2023

Affected versions
*-5.8.8
Patched versions
5.8.9
Original Wordfence record
HighCVE-2021-4447

Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation

Published: May 5, 2021

Affected versions
*-4.6.4
Patched versions
4.6.5
Original Wordfence record
HighCVE-2026-15155

Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection

Published: July 10, 2026

Affected versions
*-6.6.10
Patched versions
6.6.11
Original Wordfence record
HighCVE-2024-8979

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation

Published: November 14, 2024

Affected versions
*-6.0.9
Patched versions
6.0.10
Original Wordfence record
HighCVE-2024-1536

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar

Published: March 11, 2024

Affected versions
*-5.9.9
Patched versions
5.9.10
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory