Plugin security history

Sky Addons for Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with Sky Addons for Elementor, published between 2024 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

0Critical

2High

8Medium

0Low

0Informational

10Patched records

0Currently marked unpatched

2024-03-12First disclosure

2026-05-07Latest disclosure

10 of 10CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2024	7	7 records
2025	2	2 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	2	20%
Medium	8	80%

Vulnerability-Type Breakdown

Cross-Site Scripting

7 records70%

First: 2024. Latest: 2026.

Missing Authorization

2 records20%

First: 2024. Latest: 2024.

Information Disclosure

1 record10%

First: 2024. Latest: 2024.

Patch Status

Patched: 10
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.3.3
3.2.0
3.0.3
2.6.3
2.6.2
2.5.16
2.5.12
2.5.6
2.5.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.3.2`	Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script	May 7, 2026	3.3.3	Medium
`*-3.1.4`	Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	July 28, 2025	3.2.0	Medium
`*-3.0.1`	Sky Addons for Elementor <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 22, 2025	3.0.3	Medium
`*-2.6.1`	Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update	November 21, 2024	2.6.2	High
`*-2.6.2`	Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update	November 21, 2024	2.6.3	High
`*-2.6.1`	Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template	November 20, 2024	2.6.2	Medium
`*-2.5.15`	Sky Addons for Elementor <= 2.5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 24, 2024	2.5.16	Medium
`*-2.5.11`	Sky Addons for Elementor <= 2.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 26, 2024	2.5.12	Medium
`*-2.5.5`	Sky Addons for Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 10, 2024	2.5.6	Medium
`*-2.4.0`	Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL	March 12, 2024	2.5.0	Medium

Selected source records

Latest Records

MediumCVE-2026-7475

Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script

Published: May 7, 2026

Affected versions: *-3.3.2
Patched versions: 3.3.3

Original Wordfence record

MediumCVE-2025-8216

Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published: July 28, 2025

Affected versions: *-3.1.4
Patched versions: 3.2.0

Original Wordfence record

MediumCVE-2025-46260

Sky Addons for Elementor <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 22, 2025

Affected versions: *-3.0.1
Patched versions: 3.0.3

Original Wordfence record

HighCVE-2024-11104

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

Published: November 21, 2024

Affected versions: *-2.6.2
Patched versions: 2.6.3

Original Wordfence record

HighCVE-2024-11601

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update

Published: November 21, 2024

Affected versions: *-2.6.1
Patched versions: 2.6.2

Original Wordfence record

MediumCVE-2024-9542

Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template

Published: November 20, 2024

Affected versions: *-2.6.1
Patched versions: 2.6.2

Original Wordfence record

MediumCVE-2024-50433

Sky Addons for Elementor <= 2.5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 24, 2024

Affected versions: *-2.5.15
Patched versions: 2.5.16

Original Wordfence record

MediumCVE-2024-47332

Sky Addons for Elementor <= 2.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 26, 2024

Affected versions: *-2.5.11
Patched versions: 2.5.12

Original Wordfence record

Highest-Severity Records

HighCVE-2024-11104

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

Published: November 21, 2024

Affected versions: *-2.6.2
Patched versions: 2.6.3

Original Wordfence record

HighCVE-2024-11601

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update

Published: November 21, 2024

Affected versions: *-2.6.1
Patched versions: 2.6.2

Original Wordfence record

MediumCVE-2025-46260

Sky Addons for Elementor <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 22, 2025

Affected versions: *-3.0.1
Patched versions: 3.0.3

Original Wordfence record

MediumCVE-2025-8216

Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published: July 28, 2025

Affected versions: *-3.1.4
Patched versions: 3.2.0

Original Wordfence record

MediumCVE-2024-47332

Sky Addons for Elementor <= 2.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 26, 2024

Affected versions: *-2.5.11
Patched versions: 2.5.12

Original Wordfence record

MediumCVE-2024-50433

Sky Addons for Elementor <= 2.5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 24, 2024

Affected versions: *-2.5.15
Patched versions: 2.5.16

Original Wordfence record

MediumCVE-2024-38687

Sky Addons for Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: July 10, 2024

Affected versions: *-2.5.5
Patched versions: 2.5.6

Original Wordfence record

MediumCVE-2026-7475

Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script

Published: May 7, 2026

Affected versions: *-3.3.2
Patched versions: 3.3.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory