Plugin security history

Exclusive Addons for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Exclusive Addons for Elementor, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records

0Critical

0High

31Medium

0Low

0Informational

31Patched records

0Currently marked unpatched

2022-12-14First disclosure

2026-08-01Latest disclosure

30 of 31CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	2	2 records
2023	1	1 records
2024	19	19 records
2025	4	4 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Medium	31	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

23 records74.2%

First: 2024. Latest: 2026.

Missing Authorization

3 records9.7%

First: 2022. Latest: 2024.

Information Disclosure

3 records9.7%

First: 2024. Latest: 2026.

CSRF

2 records6.5%

First: 2022. Latest: 2023.

Patch Status

Patched: 31
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.8.1
2.7.9.9
2.8.0
2.7.9.5
2.7.9.2
2.7.9.1
2.7.7
2.7.5
2.7.2
2.6.9.9
2.6.9.7
2.6.9.2
2.6.9.4
2.6.9.5
2.6.9.3
2.6.9.1
2.6.9
2.6.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.7.9.8`	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'	August 1, 2026	2.7.9.9	Medium
`*-2.8.0`	Exclusive Addons Elementor <= 2.8.0 - Unauthenticated Information Exposure	July 27, 2026	2.8.1	Medium
`*-2.7.9.8`	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	July 6, 2026	2.7.9.9	Medium
`*-2.7.9.9`	Exclusive Addons for Elementor <= 2.7.9.9 - Unauthenticated Information Exposure	July 5, 2026	2.8.0	Medium
`*-2.7.9.8`	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 26, 2026	2.7.9.9	Medium
`*-2.7.9.4`	Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown	August 5, 2025	2.7.9.5	Medium
`*-2.7.9.1`	Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget	May 26, 2025	2.7.9.2	Medium
`*-2.7.9`	Exclusive Addons Elementor <= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 19, 2025	2.7.9.1	Medium
`*-2.7.6`	Exclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets	February 27, 2025	2.7.7	Medium
`*-2.7.4`	Exclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates	October 28, 2024	2.7.5	Medium
`*-2.7.1`	Exclusive Addons Elementor <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 15, 2024	2.7.2	Medium
`*-2.6.9.8`	Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget	June 25, 2024	2.6.9.9	Medium
`*-2.6.9.6`	Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget	May 14, 2024	2.6.9.7	Medium
`*-2.6.9.1`	Exclusive Addons Elementor <= 2.6.9.1 - Missing Authorization to Post Duplication	April 29, 2024	2.6.9.2	Medium
`*-2.6.9.4`	Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title	April 22, 2024	2.6.9.5	Medium
`*-2.6.9.3`	Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget	April 22, 2024	2.6.9.4	Medium
`*-2.6.9.4`	Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action	April 22, 2024	2.6.9.5	Medium
`*-2.6.9.2`	Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox	April 15, 2024	2.6.9.3	Medium
`*-2.6.9.2`	Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid	April 15, 2024	2.6.9.3	Medium
`*-2.6.9`	Appsero <= 2.0.0 - Missing Authorization via handle_optin_optout	April 11, 2024	2.6.9.1	Medium
`*-2.6.9`	Exclusive Addons Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 26, 2024	2.6.9.1	Medium
`*-2.6.8`	Exclusive Addons Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 25, 2024	2.6.9	Medium
`*-2.6.9`	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget	February 29, 2024	2.6.9.1	Medium
`*-2.6.9`	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget	February 29, 2024	2.6.9.1	Medium
`*-2.6.9`	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget	February 29, 2024	2.6.9.1	Medium

Selected source records

Latest Records

MediumCVE-2026-12231

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

Published: August 1, 2026

Affected versions: *-2.7.9.8
Patched versions: 2.7.9.9

Original Wordfence record

MediumCVE-2026-66438

Exclusive Addons Elementor <= 2.8.0 - Unauthenticated Information Exposure

Published: July 27, 2026

Affected versions: *-2.8.0
Patched versions: 2.8.1

Original Wordfence record

MediumCVE-2026-11328

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

Published: July 6, 2026

Affected versions: *-2.7.9.8
Patched versions: 2.7.9.9

Original Wordfence record

MediumCVE-2026-59511

Exclusive Addons for Elementor <= 2.7.9.9 - Unauthenticated Information Exposure

Published: July 5, 2026

Affected versions: *-2.7.9.9
Patched versions: 2.8.0

Original Wordfence record

MediumCVE-2026-57620

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 26, 2026

Affected versions: *-2.7.9.8
Patched versions: 2.7.9.9

Original Wordfence record

MediumCVE-2025-7498

Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown

Published: August 5, 2025

Affected versions: *-2.7.9.4
Patched versions: 2.7.9.5

Original Wordfence record

MediumCVE-2025-4783

Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget

Published: May 26, 2025

Affected versions: *-2.7.9.1
Patched versions: 2.7.9.2

Original Wordfence record

MediumCVE-2025-48244

Exclusive Addons Elementor <= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: May 19, 2025

Affected versions: *-2.7.9
Patched versions: 2.7.9.1

Original Wordfence record

Highest-Severity Records

MediumCVE-2024-1234

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 29, 2024

Affected versions: *-2.6.9
Patched versions: 2.6.9.1

Original Wordfence record

MediumCVE-2024-3985

Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action

Published: April 22, 2024

Affected versions: *-2.6.9.4
Patched versions: 2.6.9.5

Original Wordfence record

MediumCVE-2024-2503

Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid

Published: April 15, 2024

Affected versions: *-2.6.9.2
Patched versions: 2.6.9.3

Original Wordfence record

MediumCVE-2024-4618

Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget

Published: May 14, 2024

Affected versions: *-2.6.9.6
Patched versions: 2.6.9.7

Original Wordfence record

MediumCVE-2024-2750

Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

Published: April 22, 2024

Affected versions: *-2.6.9.3
Patched versions: 2.6.9.4

Original Wordfence record

MediumCVE-2024-49292

Exclusive Addons Elementor <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 15, 2024

Affected versions: *-2.7.1
Patched versions: 2.7.2

Original Wordfence record

MediumCVE-2025-7498

Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown

Published: August 5, 2025

Affected versions: *-2.7.9.4
Patched versions: 2.7.9.5

Original Wordfence record

MediumCVE-2026-11328

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

Published: July 6, 2026

Affected versions: *-2.7.9.8
Patched versions: 2.7.9.9

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory