Vulnerabilities and security researches foressential-addons-for-elementor-lite essential-addons-for-elementor-lite
Direction: descendingApr 17, 2025
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2025-39590
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 16, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS. This issue affects Essential Addons for Elementor: from n/a through 6.1.9.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2025-39589
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 16, 2025
- Research Description
- Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor allows Retrieve Embedded Sensitive Data. This issue affects Essential Addons for Elementor: from n/a through 6.1.9.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Dec 21, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-56063
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 01, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.0.7.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Nov 16, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-8978
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 15, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Login | Register Form widget, as long as that user opens the email notification for successful registration.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-8961
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 15, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-8979
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 15, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including usernames and passwords of any user, including Administrators, as long as that user opens the email notification for a password change request and images are not blocked by the email client.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Oct 18, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2021-4447
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 16, 2024
- Research Description
- The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2021-4446
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 16, 2024
- Research Description
- The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Sep 13, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-8742
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 13, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Sep 11, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-8440
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 11, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Aug 13, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-7092
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 13, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘no_more_items_text’ parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Aug 07, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-39649
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 02, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 5.9.26.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Jun 13, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-5189
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 11, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Jun 07, 2024
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2022-0683
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 25, 2022
- Research Description
- The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-1236
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 29, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2021-24255
- CVE, Research URL
- Home page URL
- Application
- Date
- May 06, 2021
- Research Description
- The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2023-3779
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 20, 2023
- Research Description
- The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. This only affects sites running the premium version of the plugin and that have the Mailchimp block enabled on a page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-0586
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 06, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Login/Register Element in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escaping on the custom login URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-1171
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 29, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-0585
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 06, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escaping on the Image URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-0954
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 06, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient input sanitization and output escaping on user supplied protocols. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2022-0320
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 01, 2022
- Research Description
- The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2023-41955
- CVE, Research URL
- Home page URL
- Application
- Date
- May 17, 2024
- Research Description
- Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2023-32243
- CVE, Research URL
- Home page URL
- Application
- Date
- May 12, 2023
- Research Description
- Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2023-7044
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 04, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-3333
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 17, 2024
- Research Description
- The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in all versions up to, and including, 5.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-4156
- CVE, Research URL
- Home page URL
- Application
- Date
- May 02, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-4275
- CVE, Research URL
- Home page URL
- Application
- Date
- May 14, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Interactive Circle widget in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-1537
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 13, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Data Table widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-1536
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 13, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-2650
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the alignment parameter in the Woo Product Carousel widget in all versions up to, and including, 5.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-3018
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 30, 2024
- Research Description
- The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-3728
- CVE, Research URL
- Home page URL
- Application
- Date
- May 02, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery & Interactive Circle widgets in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-4003
- CVE, Research URL
- Home page URL
- Application
- Date
- May 02, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_team_members_image_rounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-4448
- CVE, Research URL
- Home page URL
- Application
- Date
- May 14, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-1276
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 29, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Content Ticker arrow attribute in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-1172
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 29, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion widget in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-2623
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-2974
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.9.13 via the load_more function. This can allow unauthenticated attackers to extract sensitive data including private and draft posts.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-3733
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 25, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.9.15 via the ajax_load_more() , eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions. This makes it possible for unauthenticated attackers to extract posts that may be in private or draft status.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-4624
- CVE, Research URL
- Home page URL
- Application
- Date
- May 14, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-4449
- CVE, Research URL
- Home page URL
- Application
- Date
- May 14, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Fancy Text', 'Filter Gallery', 'Sticky Video', 'Content Ticker', 'Woo Product Gallery', & 'Twitter Feed' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-34764
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 03, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 5.9.15.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-5073
- CVE, Research URL
- Home page URL
- Application
- Date
- May 30, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders # CVE-2024-5188
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 06, 2024
- Research Description
- The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable