Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Exclusive Addons for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Exclusive Addons for Elementor, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records
0Critical
0High
31Medium
0Low
0Informational
31Patched records
0Currently marked unpatched
2022-12-14First disclosure
2026-08-01Latest disclosure
30 of 31CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
202222 records
202311 records
20241919 records
202544 records
202655 records

Severity Breakdown

SeverityRecordsShare
Medium31100%

Vulnerability-Type Breakdown

Cross-Site Scripting

23 records74.2%

First: 2024. Latest: 2026.

Missing Authorization

3 records9.7%

First: 2022. Latest: 2024.

Information Disclosure

3 records9.7%

First: 2024. Latest: 2026.

CSRF

2 records6.5%

First: 2022. Latest: 2023.

Patch Status

Patched
31
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.8.1
  • 2.7.9.9
  • 2.8.0
  • 2.7.9.5
  • 2.7.9.2
  • 2.7.9.1
  • 2.7.7
  • 2.7.5
  • 2.7.2
  • 2.6.9.9
  • 2.6.9.7
  • 2.6.9.2
  • 2.6.9.4
  • 2.6.9.5
  • 2.6.9.3
  • 2.6.9.1
  • 2.6.9
  • 2.6.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-2.6.9Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingFebruary 29, 20242.6.9.1Medium
*-2.6.8Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link AnythingJanuary 26, 20242.6.9Medium
*-2.6.8Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingJanuary 26, 20242.6.9Medium
*-2.6.1Exclusive Addons for Elementor <= 2.6.1 - Cross-Site Request ForgeryJanuary 7, 20232.6.2Medium
*-2.6.1Appsero <= 1.2.1 - Missing AuthorizationDecember 16, 20222.6.2Medium
*-2.6.1Appsero <= 1.2.0 - Cross-Site Request ForgeryDecember 14, 20222.6.2Medium

Selected source records

Latest Records

MediumCVE-2026-12231

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

Published: August 1, 2026

Affected versions
*-2.7.9.8
Patched versions
2.7.9.9
Original Wordfence record
MediumCVE-2026-66438

Exclusive Addons Elementor <= 2.8.0 - Unauthenticated Information Exposure

Published: July 27, 2026

Affected versions
*-2.8.0
Patched versions
2.8.1
Original Wordfence record
MediumCVE-2026-11328

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

Published: July 6, 2026

Affected versions
*-2.7.9.8
Patched versions
2.7.9.9
Original Wordfence record
MediumCVE-2026-59511

Exclusive Addons for Elementor <= 2.7.9.9 - Unauthenticated Information Exposure

Published: July 5, 2026

Affected versions
*-2.7.9.9
Patched versions
2.8.0
Original Wordfence record
MediumCVE-2026-57620

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 26, 2026

Affected versions
*-2.7.9.8
Patched versions
2.7.9.9
Original Wordfence record
MediumCVE-2025-7498

Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown

Published: August 5, 2025

Affected versions
*-2.7.9.4
Patched versions
2.7.9.5
Original Wordfence record
MediumCVE-2025-4783

Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget

Published: May 26, 2025

Affected versions
*-2.7.9.1
Patched versions
2.7.9.2
Original Wordfence record
MediumCVE-2025-48244

Exclusive Addons Elementor <= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: May 19, 2025

Affected versions
*-2.7.9
Patched versions
2.7.9.1
Original Wordfence record

Highest-Severity Records

MediumCVE-2024-1234

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 29, 2024

Affected versions
*-2.6.9
Patched versions
2.6.9.1
Original Wordfence record
MediumCVE-2024-3985

Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action

Published: April 22, 2024

Affected versions
*-2.6.9.4
Patched versions
2.6.9.5
Original Wordfence record
MediumCVE-2024-2503

Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid

Published: April 15, 2024

Affected versions
*-2.6.9.2
Patched versions
2.6.9.3
Original Wordfence record
MediumCVE-2024-4618

Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget

Published: May 14, 2024

Affected versions
*-2.6.9.6
Patched versions
2.6.9.7
Original Wordfence record
MediumCVE-2024-2750

Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

Published: April 22, 2024

Affected versions
*-2.6.9.3
Patched versions
2.6.9.4
Original Wordfence record
MediumCVE-2024-49292

Exclusive Addons Elementor <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 15, 2024

Affected versions
*-2.7.1
Patched versions
2.7.2
Original Wordfence record
MediumCVE-2025-7498

Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown

Published: August 5, 2025

Affected versions
*-2.7.9.4
Patched versions
2.7.9.5
Original Wordfence record
MediumCVE-2026-11328

Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

Published: July 6, 2026

Affected versions
*-2.7.9.8
Patched versions
2.7.9.9
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory