WordPress security by component
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Plugin description
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce is a WordPress component with 22 published CVE records in this archive. The latest tracked vulnerability was published Feb 01, 2025; the highest CVE/CNA score is 9.8.
Plugin slug:
the-plus-addons-for-elementorLatest vulnerability
CVE-2024-11829: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Cross-site scripting
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
| Safe version |
|
||
|---|---|---|---|
| Feb 01, 2025 |
CVE-2024-11829
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Cross-site scripting
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Dec 06, 2024 |
CVE-2024-53823
The Plus Addons for Elementor Page Builder Lite: Cross-site scripting
The Plus Addons for Elementor Page Builder Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Nov 20, 2024 |
CVE-2024-10365
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Sensitive information exposure
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Nov 01, 2024 |
CVE-2024-43932
The Plus Addons for Elementor Page Builder Lite: A security weakness
The Plus Addons for Elementor Page Builder Lite is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD8.8
|
| Oct 11, 2024 |
CVE-2024-8913
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Sensitive information exposure
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Sep 17, 2024 |
CVE-2024-43977
The Plus Addons for Elementor Page Builder Lite: Cross-site scripting
The Plus Addons for Elementor Page Builder Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD5.4
|
| Jun 21, 2024 |
CVE-2024-5455
Plus Addons for Elementor Page Builder: Filesystem traversal
Plus Addons for Elementor Page Builder is affected by filesystem traversal. Exploitation requires at least contributor-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jun 21, 2024 |
CVE-2024-5344
The Plus Addons for Elementor Page Builder: Cross-site scripting
The Plus Addons for Elementor Page Builder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| May 30, 2024 |
CVE-2024-5341
The Plus Addons for Elementor Page Builder: Cross-site scripting
The Plus Addons for Elementor Page Builder is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 24, 2024 |
CVE-2024-2784
The Plus Addons for Elementor: Cross-site scripting
The Plus Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 02, 2024 |
CVE-2024-3197
The Plus Addons for Elementor: Cross-site scripting
The Plus Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Mar 27, 2024 |
CVE-2024-2210
The Plus Addons for Elementor: Filesystem traversal
The Plus Addons for Elementor is affected by filesystem traversal. Exploitation requires at least contributor-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Mar 27, 2024 |
CVE-2024-2203
The Plus Addons for Elementor: Filesystem traversal
The Plus Addons for Elementor is affected by filesystem traversal. Exploitation requires at least contributor-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.4
NVD8.8
|
| Mar 07, 2024 |
CVE-2024-1419
The Plus Addons for Elementor: Cross-site scripting
The Plus Addons for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Mar 07, 2023 |
CVE-2021-4332
Plus Addons for Elementor: Filesystem traversal
Plus Addons for Elementor is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Mar 07, 2023 |
CVE-2021-4331
Plus Addons for Elementor: Privilege escalation or authentication bypass
Plus Addons for Elementor is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jan 10, 2022 |
CVE-2021-24949
"WP Search Filters" widget of The Plus Addons for Elementor - Pro: SQL injection
"WP Search Filters" widget of The Plus Addons for Elementor - Pro is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jan 10, 2022 |
CVE-2021-24948
Plus Addons for Elementor - Pro: A security weakness
Plus Addons for Elementor - Pro is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVD7.5
|
| Jun 14, 2021 |
CVE-2021-24359
Plus Addons for Elementor Page Builder: Privilege escalation or authentication bypass
Plus Addons for Elementor Page Builder is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE5.3
NVD5.3
|
| Jun 14, 2021 |
CVE-2021-24358
Plus Addons for Elementor Page Builder: An open redirect
Plus Addons for Elementor Page Builder is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jun 14, 2021 |
CVE-2021-24351
theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder: Cross-site scripting
theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Apr 05, 2021 |
CVE-2021-24175
Plus Addons for Elementor Page Builder: A security weakness
Plus Addons for Elementor Page Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|