Plugin security history

Premium Addons for Elementor – Powerful Elementor Templates & Widgets Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 38 vulnerability records associated with Premium Addons for Elementor – Powerful Elementor Templates & Widgets, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

38Total records

0Critical

0High

37Medium

1Low

0Informational

38Patched records

0Currently marked unpatched

2021-04-13First disclosure

2026-07-10Latest disclosure

38 of 38CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	2	2 records
2024	28	28 records
2025	5	5 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Medium	37	97.4%
Low	1	2.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

28 records73.7%

First: 2021. Latest: 2026.

Missing Authorization

6 records15.8%

First: 2021. Latest: 2026.

Information Disclosure

2 records5.3%

First: 2024. Latest: 2025.

Other

1 record2.6%

First: 2024. Latest: 2024.

CSRF

1 record2.6%

First: 2025. Latest: 2025.

Patch Status

Patched: 38
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.11.85
4.11.71
4.11.64
4.11.54
4.10.70
4.11.9
4.10.57
4.10.61
4.10.53
4.10.39
4.10.37
4.10.35
4.10.36
4.10.34
4.10.32
4.10.31
4.10.29
4.10.26
4.10.28
4.10.25
4.10.17
4.10.23
4.10.24
4.0.18
4.10.22
4.10.19
4.5.2
4.2.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.11.84`	Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter	July 10, 2026	4.11.85	Medium
`*-4.11.70`	Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter	May 1, 2026	4.11.71	Medium
`*-4.11.63`	Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber+) Settings Update	January 17, 2026	4.11.64	Medium
`*-4.11.53`	Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'	December 22, 2025	4.11.54	Medium
`*-4.11.53`	Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'	December 22, 2025	4.11.54	Medium
`*-4.11.53`	Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure	December 4, 2025	4.11.54	Medium
`*-4.10.69`	Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 3, 2025	4.10.70	Medium
`*-4.11.8`	Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	June 9, 2025	4.11.9	Medium
`*-4.10.56`	Premium Addons for Elementor <= 4.10.56 - Missing Authorization	December 19, 2024	4.10.57	Medium
`*-4.10.60`	Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget	October 28, 2024	4.10.61	Medium
`*-4.10.52`	Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget	September 26, 2024	4.10.53	Medium
`*-4.10.38`	Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update	August 7, 2024	4.10.39	Medium
`*-4.10.36`	Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget	July 11, 2024	4.10.37	Medium
`*-4.10.34`	Premium Addons for Elementor <= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 9, 2024	4.10.35	Medium
`*-4.10.35`	Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service	July 3, 2024	4.10.36	Low
`*-4.10.36`	Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	July 2, 2024	4.10.37	Medium
`*-4.10.33`	Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	June 11, 2024	4.10.34	Medium
`*-4.10.31`	Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget	May 30, 2024	4.10.32	Medium
`*-4.10.31`	Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip	May 30, 2024	4.10.32	Medium
`*-4.10.31`	Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure	May 30, 2024	4.10.32	Medium
`*-4.10.31`	Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider	May 22, 2024	4.10.32	Medium
`*-4.10.30`	Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 29, 2024	4.10.31	Medium
`*-4.10.28`	Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'	April 24, 2024	4.10.29	Medium
`*-4.10.28`	Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 23, 2024	4.10.29	Medium
`*-4.10.25`	Premium Addons for Elementor <= 4.10.25 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 22, 2024	4.10.26	Medium

Selected source records

Latest Records

MediumCVE-2026-12141

Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter

Published: July 10, 2026

Affected versions: *-4.11.84
Patched versions: 4.11.85

Original Wordfence record

MediumCVE-2026-4790

Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter

Published: May 1, 2026

Affected versions: *-4.11.70
Patched versions: 4.11.71

Original Wordfence record

MediumCVE-2025-69300

Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber+) Settings Update

Published: January 17, 2026

Affected versions: *-4.11.63
Patched versions: 4.11.64

Original Wordfence record

MediumCVE-2025-14155

Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'

Published: December 22, 2025

Affected versions: *-4.11.53
Patched versions: 4.11.54

Original Wordfence record

MediumCVE-2025-14163

Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'

Published: December 22, 2025

Affected versions: *-4.11.53
Patched versions: 4.11.54

Original Wordfence record

MediumCVE-2025-68494

Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure

Published: December 4, 2025

Affected versions: *-4.11.53
Patched versions: 4.11.54

Original Wordfence record

MediumCVE-2024-11937

Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: July 3, 2025

Affected versions: *-4.10.69
Patched versions: 4.10.70

Original Wordfence record

MediumCVE-2025-4774

Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Published: June 9, 2025

Affected versions: *-4.11.8
Patched versions: 4.11.9

Original Wordfence record

Highest-Severity Records

MediumCVE-2024-37922

Premium Addons for Elementor <= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: July 9, 2024

Affected versions: *-4.10.34
Patched versions: 4.10.35

Original Wordfence record

MediumCVE-2021-4445

Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update

Published: August 30, 2021

Affected versions: *-4.5.1
Patched versions: 4.5.2

Original Wordfence record

MediumCVE-2024-6495

Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget

Published: July 11, 2024

Affected versions: *-4.10.36
Patched versions: 4.10.37

Original Wordfence record

MediumCVE-2025-4774

Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Published: June 9, 2025

Affected versions: *-4.11.8
Patched versions: 4.11.9

Original Wordfence record

MediumCVE-2024-0376

Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget

Published: April 9, 2024

Affected versions: *-4.10.16
Patched versions: 4.10.17

Original Wordfence record

MediumCVE-2024-1242

Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 14, 2024

Affected versions: *-4.10.18
Patched versions: 4.10.19

Original Wordfence record

MediumCVE-2024-0326

Premium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper

Published: March 12, 2024

Affected versions: *-4.0.17
Patched versions: 4.0.18

Original Wordfence record

MediumCVE-2024-11937

Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: July 3, 2025

Affected versions: *-4.10.69
Patched versions: 4.10.70

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory