Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · addon-elements-for-elementor-page-builder
Elementor Addon Elements
28 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 22, 2026Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114184 · affects up to 1.14.4 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.
Feb 26, 2026Elementor Addon Elements: Insertion of Sensitive Information Into Sent DataCVE-2026-28131 · affects up to 1.14.4 · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through <= 1.14.4.
Dec 14, 2025Addon Elements for Elementor: Stored Cross-Site ScriptingCVE-2025-12537 · affects up to 1.14.3 · reported by WordfenceMedium 6.4
The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page.
Jan 15, 2025Elementor Addon Elements: Sensitive Information ExposureCVE-2024-13215 · affects up to 1.13.10 · reported by WordfenceMedium 4.3
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Elementor Addon Elements: Missing AuthorizationCVE-2024-47361 · affects up to 1.13.6 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.
Oct 12, 2024Elementor Addon Elements: Sensitive Information ExposureCVE-2024-8902 · affects up to 1.13.8 · reported by WordfenceMedium 4.3
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Oct 6, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47366 · affects up to 1.13.6 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.
Aug 30, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-7122 · affects up to 1.13.6 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-4401 · affects up to 1.13.5 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' parameters in all versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-4570 · affects up to 1.13.5 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-4569 · affects up to 1.13.5 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-2092 · affects up to 1.13.3 · reported by WordfenceMedium 5.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-3743 · affects up to 1.13.3 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group, Shape Separator, Content Switcher, Info Circle and Timeline widgets in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-2792 · affects up to 1.13.2 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 28, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30422 · affects up to 1.13.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.1.
Mar 27, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-2091 · affects up to 1.13.2 · reported by WordfenceMedium 5.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29107 · affects up to 1.12.10 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.12.10.
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1422 · affects up to 1.12.12 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1393 · affects up to 1.12.12 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content Switcher widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1392 · affects up to 1.12.12 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual Button widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1391 · affects up to 1.12.12 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribute of the Thumbnail Slider widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Directory TraversalCVE-2024-1358 · affects up to 1.12.12 · reported by WordfenceHigh 8.8
The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-0834 · affects up to 1.12.11 · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up to, and including, 1.12.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2023Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2023-5381 · affects up to 1.12.7 · reported by WordfenceMedium 4.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2023Elementor Addon Elements: Sensitive Information ExposureCVE-2023-4723 · affects up to 1.12.7 · reported by WordfenceMedium 5.3
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/page ids and titles including those of with pending/draft/future/private status.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2023Elementor Addon Elements: Cross-Site Request ForgeryCVE-2023-4690 · affects up to 1.12.7 · reported by WordfenceMedium 5.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_config function. This makes it possible for unauthenticated attackers to change configuration settings for the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2023Elementor Addon Elements: Cross-Site Request ForgeryCVE-2023-4689 · affects up to 1.12.7 · reported by WordfenceMedium 5.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_elements function. This makes it possible for unauthenticated attackers to enable/disable elementor addon elements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 5, 2021Elementor Addon Elements: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24259 · fixed in 1.11.2 · reported by WPScanMedium 5.4
The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.