WordPress security by component

Exclusive Addons for Elementor

Plugin description

Exclusive Addons for Elementor adds Elementor widgets and design elements for creating customized WordPress pages and website layouts.

Exclusive Addons for Elementor (exclusive-addons-for-elementor) is a WordPress plugin with 29 published CVE records in this archive. The latest tracked vulnerability was published Aug 02, 2026; the highest published CVSS base score is 6.5.

Plugin slug: exclusive-addons-for-elementor

Latest vulnerability

CVE-2026-12231: Exclusive Addons Info Box images let Contributors store JavaScript

Exclusive Addons for Elementor through 2.7.9.8 lets a Contributor-or-higher user store attacker-controlled image data in the exad_infobox_image setting. The Info Box element's Elementor content template obtains the image URL with elementor.imagesManager.getImageUrl() and inserts it into an img src attribute with an unescaped triple-brace template expression, allowing crafted input to break out of the attribute and execute JavaScript when the injected page is rendered. Version 2.7.9.9 applies _.escape() to the returned image URL before output.

PublishedAug 02, 2026

Known safe version2.7.9.9

Published vulnerabilities for exclusive-addons-for-elementor
		Safe version
Aug 02, 2026	CVE-2026-12231 Exclusive Addons Info Box images let Contributors store JavaScript Exclusive Addons for Elementor through 2.7.9.8 lets a Contributor-or-higher user store attacker-controlled image data in the exad_infobox_image setting. The Info Box element's Elementor content template obtains the image URL with elementor.imagesManager.getImageUrl() and inserts it into an img src attribute with an unescaped triple-brace template expression, allowing crafted input to break out of the attribute and execute JavaScript when the injected page is rendered. Version 2.7.9.9 applies _.escape() to the returned image URL before output.	2.7.9.9	CVE6.4
Jul 27, 2026	CVE-2026-66438 Exclusive Addons Elementor exposes protected data without authentication Exclusive Addons Elementor through 2.8.0 permits an unauthenticated request to retrieve protected data.	2.8.1	CVE5.3
Jul 07, 2026	CVE-2026-11328 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.7.9.8.	See mitigation notes	CVE6.4
Jul 05, 2026	CVE-2026-59511 Exclusive Addons Elementor: A security weakness Exclusive Addons Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.7.9.9.	2.8.0	CVE5.3
Jun 26, 2026	CVE-2026-57620 Exclusive Addons Elementor: Cross-site scripting Exclusive Addons Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.7.9.8.	2.7.9.9	CVE6.5
Aug 06, 2025	CVE-2025-7498 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 27, 2025	CVE-2025-4783 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 19, 2025	CVE-2025-48244 Exclusive Addons Elementor: Cross-site scripting Exclusive Addons Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Feb 28, 2025	CVE-2025-1571 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Oct 29, 2024	CVE-2024-10312 Exclusive Addons for Elementor: Sensitive information exposure Exclusive Addons for Elementor is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE4.3
Oct 17, 2024	CVE-2024-49292 Exclusive Addons Elementor: Cross-site scripting Exclusive Addons Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Jun 26, 2024	CVE-2024-5332 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 15, 2024	CVE-2024-4618 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 03, 2024	CVE-2024-33914 Exclusive Addons Elementor: A security weakness Exclusive Addons Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
May 02, 2024	CVE-2024-3985 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 02, 2024	CVE-2024-3489 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 02, 2024	CVE-2024-2751 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 02, 2024	CVE-2024-2750 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
May 02, 2024	CVE-2024-2503 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Apr 16, 2024	CVE-2024-32557 Exclusive Addons Elementor: Cross-site scripting Exclusive Addons Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Mar 27, 2024	CVE-2024-30177 Exclusive Addons Elementor: Cross-site scripting Exclusive Addons Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Mar 26, 2024	CVE-2024-30232 Exclusive Addons Elementor: Cross-site scripting Exclusive Addons Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Mar 13, 2024	CVE-2024-2028 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 13, 2024	CVE-2024-1414 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 13, 2024	CVE-2024-1413 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 13, 2024	CVE-2024-1234 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Feb 05, 2024	CVE-2024-0823 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4
Jan 27, 2024	CVE-2024-0824 Exclusive Addons for Elementor: Cross-site scripting Exclusive Addons for Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Feb 02, 2023	CVE-2022-45067 Exclusive Addons For Elementor: Cross-site request forgery Exclusive Addons For Elementor is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers