Plugin security history

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 41 vulnerability records associated with The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

41Total records

0Critical

1High

40Medium

0Low

0Informational

41Patched records

0Currently marked unpatched

2021-04-13First disclosure

2026-05-28Latest disclosure

39 of 41CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	3	3 records
2024	24	24 records
2025	6	6 records
2026	8	8 records

Severity Breakdown

Severity	Records	Share
High	1	2.4%
Medium	40	97.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

31 records75.6%

First: 2021. Latest: 2026.

Missing Authorization

4 records9.8%

First: 2021. Latest: 2026.

Path Traversal

3 records7.3%

First: 2021. Latest: 2024.

Information Disclosure

2 records4.9%

First: 2024. Latest: 2024.

Other

1 record2.4%

First: 2026. Latest: 2026.

Patch Status

Patched: 41
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.4.16
6.4.12
6.4.10
6.4.8
6.3.16
6.3.14
6.3.11
6.2.8
6.2.3
6.2.0
6.0.1
6.0.4
5.6.12
5.6.3
5.6.2
5.6.1
5.5.3
5.5.5
5.5.0
5.4.2
5.4.1
5.3.4
4.1.10
2.0.7
2.0.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.4.15`	The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter	May 28, 2026	6.4.16	Medium
`*-6.4.11`	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	May 21, 2026	6.4.12	Medium
`*-6.4.11`	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 21, 2026	6.4.12	Medium
`*-6.4.11`	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 21, 2026	6.4.12	Medium
`*-6.4.11`	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget	May 13, 2026	6.4.12	Medium
`*-6.4.9`	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar	April 7, 2026	6.4.10	Medium
`*-6.4.7`	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay	February 21, 2026	6.4.8	Medium
`*-6.4.7`	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'	February 18, 2026	6.4.8	Medium
`*-6.3.15`	The Plus Addons for Elementor <= 6.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG	September 22, 2025	6.3.16	Medium
`*-6.3.13`	The Plus Addons for Elementor Page Builder Lite <= 6.3.13 - Missing Authorization	August 14, 2025	6.3.14	Medium
`*-6.3.10`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 31, 2025	6.3.11	Medium
`*-6.2.7`	The Plus Addons for Elementor Page Builder Lite <= 6.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 30, 2025	6.2.8	Medium
`*-6.2.2`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	March 7, 2025	6.2.3	Medium
`*-6.1.8`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 31, 2025	6.2.0	Medium
`*-5.6.14`	The Plus Addons for Elementor Page Builder Lite <= 5.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 2, 2024	6.0.1	Medium
`*-6.0.3`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates	November 19, 2024	6.0.4	Medium
`*-5.6.11`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template	October 10, 2024	5.6.12	Medium
`*-5.6.2`	The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Authenticated (Author+) Stored Cross-Site Scripting	August 28, 2024	5.6.3	Medium
`*-5.6.2`	The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Missing Authorization	August 26, 2024	5.6.3	Medium
`*-5.6.2`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings	August 21, 2024	5.6.3	Medium
`*-5.6.2`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget	August 19, 2024	5.6.3	Medium
`*-5.6.2`	The Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget	August 19, 2024	5.6.3	Medium
`*-5.6.1`	The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	July 2, 2024	5.6.2	Medium
`*-5.6.0`	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting	June 26, 2024	5.6.1	Medium
`*-5.5.4`	The Plus Addons for Elementor Page Builder Lite <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 6, 2024	5.5.5	Medium

Selected source records

Latest Records

MediumCVE-2026-9243

The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter

Published: May 28, 2026

Affected versions: *-6.4.15
Patched versions: 6.4.16

Original Wordfence record

MediumCVE-2026-15285

The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

Published: May 21, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

Medium

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 21, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

Medium

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 21, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

MediumCVE-2026-5243

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget

Published: May 13, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

MediumCVE-2026-3311

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar

Published: April 7, 2026

Affected versions: *-6.4.9
Patched versions: 6.4.10

Original Wordfence record

MediumCVE-2026-2385

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay

Published: February 21, 2026

Affected versions: *-6.4.7
Patched versions: 6.4.8

Original Wordfence record

MediumCVE-2026-2386

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'

Published: February 18, 2026

Affected versions: *-6.4.7
Patched versions: 6.4.8

Original Wordfence record

Highest-Severity Records

HighCVE-2021-4331

The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege Escalation

Published: April 14, 2021

Affected versions: *-4.1.9
Patched versions: 4.1.10

Affected versions: *-2.0.6
Patched versions: 2.0.7

Original Wordfence record

MediumCVE-2021-4332

The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read

Published: April 14, 2021

Affected versions: *-2.0.6; 4.0-4.1.9
Patched versions: 2.0.7, 4.1.10

Original Wordfence record

Medium

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 21, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

MediumCVE-2024-3718

The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box

Published: May 23, 2024

Affected versions: *-5.5.4
Patched versions: 5.5.5

Original Wordfence record

MediumCVE-2024-4482

The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Published: July 2, 2024

Affected versions: *-5.6.1
Patched versions: 5.6.2

Original Wordfence record

MediumCVE-2024-2210

The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing

Published: March 26, 2024

Affected versions: *-5.4.1
Patched versions: 5.4.2

Original Wordfence record

MediumCVE-2026-5243

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget

Published: May 13, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

Medium

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 21, 2026

Affected versions: *-6.4.11
Patched versions: 6.4.12

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory