CVE-2024-4378

CVE-2024-4378 affects Premium Addons for Elementor on WordPress. The vulnerability is Stored XSS in the plugin’s menu and shape widgets due to insufficient input sanitization/output escaping for user-supplied attributes in versions up to 4.10.30. It requires authentication at contributor level or...

CVE-2024-32791

CVE-2024-32791 affects Premium Addons for Elementor (LeaP13 Premium Addons for Elementor) with a Stored XSS in versions up to 4.10.25 due to improper input neutralization during web page generation. Affected product: Premium Addons for Elementor. Root cause: insufficient escaping/validation of sh...

CVE-2024-1242

The CVE-2024-1242 entry affects Premium Addons for Elementor (WordPress). Root cause: stored XSS via the button onclick attribute due to insufficient input sanitization and output escaping, exploitable by authenticated users with Contributor+ privileges. Affected versions: up to 4.10.18. Impact d...

CVE-2024-2399

CVE-2024-2399 affects the Premium Addons for Elementor plugin for WordPress. It is a Stored XSS vulnerability via widget attributes caused by insufficient input sanitization and output escaping in versions up to and including 4.10.23. Exploitation requires an authenticated attacker with contribut...

CVE-2024-3885

CVE-2024-3885 affects Premium Addons for Elementor for WordPress. The issue is Stored XSS via the subcontainer_value parameter due to insufficient input sanitization and output escaping in all versions up to 4.10.28. Exploitation requires authenticated access (contributor or higher) and can injec...

CVE-2023-34012

CVE-2023-34012 affects Premium Addons for Elementor Premium Addons PRO (WordPress) up to version 2.8.24, with an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. The issue is fixed in version 2.8.25; update to that version or apply vendor guidance. The vulnerability is not desc...

CVE-2024-37922

CVE-2024-37922 is a Stored XSS in Leap13 Premium Addons for Elementor (WordPress) affecting Premium Addons for Elementor up to version 4.10.34. The underlying issue is improper neutralization of input during web page generation. A patch exists (update to a version later than 4.10.34); apply the f...

CVE-2024-24831

CVE-2024-24831 affects WordPress Premium Addons for Elementor (Leap13 Premium Addons for Elementor) and is a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. Multiple sources identify the vulnerable range as Premium Addons for Elementor ...

CVE-2024-2664

CVE-2024-2664 affects Premium Addons for Elementor (WordPress). Stored XSS via Countdown Widget in all versions

CVE-2024-4376

CVE-2024-4376 concerns the Premium Addons for Elementor WordPress plugin. The connected data confirms a Stored Cross-Site Scripting (Stored XSS) vulnerability in the Fancy Text widget, affecting all versions up to 4.10.31 due to insufficient input sanitization and output escaping. Exploitation re...

CVE-2024-31278

CVE-2024-31278 : Premium Addons for Elementor (Leap13) exposes sensitive information to an unauthorized actor. Affected: Elementor Premium Addons versions up to 4.10.22. Root cause/details of the exposure are not fully provided in the documents; the impact is sensitive information disclosure. Pat...

CVE-2025-4774

The CVE-2025-4774 entry concerns the Premium Addons for Elementor WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the Countdown widget via the data-countdown attribute due to insufficient input sanitization and output escaping. The vulnerability is present in all versions up ...

CVE-2024-3647

CVE-2024-3647 affects the Premium Addons for Elementor plugin for WordPress, specifically the Post Ticker widget. The issue is a stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated users ...

CVE-2024-0326

CVE-2024-0326 affects Premium Addons for Elementor for WordPress. It is a Stored Cross-Site Scripting (XSS) vulnerability in the Link Wrapper feature across all versions up to and including 4.10.17. The issue arises from insufficient input sanitization and output escaping on user-supplied links, ...

CVE-2024-4203

The CVE-2024-4203 entry concerns the Premium Addons Pro for Elementor WordPress plugin. It enables Stored XSS via the maps widget in versions up to 4.10.30 due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least contributor-level acce...

CVE-2024-4205

CVE-2024-4205 concerns the WordPress plugin Premium Addons for Elementor. The vulnerability affects all versions up to and including 4.10.31 and enables unauthorized data access due to a missing capability check in get_template_content(), allowing authenticated users with subscriber-level access ...

CVE-2021-4445

The CVE-2021-4445 vulnerability affects the WordPress plugin Premium Addons for Elementor (versions up to and including 4.5.1). The root cause is missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action, allowing authenticated subscriber+ attackers to perform Arbitrary Optio...

CVE-2024-4379

The CVE-2024-4379 vulnerability affects Premium Addons for Elementor (WordPress) and is a DOM-based Stored Cross-Site Scripting issue in the Global Tooltip widget. It exists in all versions up to 4.10.31 due to insufficient input sanitization and output escaping on user-supplied attributes. Explo...

CVE-2024-56225

Summary: CVE-2024-56225 affects the WordPress plugin “Premium Addons for Elementor” ( Leap13) prior to version 4.10.57. The root cause is a missing authorization check, allowing access to functionality not properly constrained by ACLs. What’s affected: Premium Addons for Elementor versions before...

CVE-2024-6340

The CVE-2024-6340 entry concerns Premium Addons for Elementor (WordPress). It describes a Stored Cross-Site Scripting (XSS) vulnerability in the Countdown widget, caused by insufficient input sanitization and output escaping for user-supplied attributes. Affected versions are all up to and includ...

CVE-2024-6434

The CVE CVE-2024-6434 affects Premium Addons for Elementor (WordPress). It is a Regular Expression Denial of Service (ReDoS) in how user input is processed as a regex, impacting all versions up to 4.10.35. The issue can be triggered by authenticated attackers with Author-level access or higher wh...

CVE-2024-10266

CVE-2024-10266 affects the Premium Addons for Elementor plugin (WordPress). The vulnerability is a stored cross-site scripting flaw in the Video Box widget, exploitable by authenticated attackers with contributor-level access or higher. It affects all versions up to and including 4.10.60; the iss...

CVE-2024-2665

Premium Addons for Elementor (WordPress) is affected up to version 4.10.27. The flaw is a Stored XSS in the plugin’s button due to insufficient input sanitization and output escaping for user-supplied attributes. Exploitation requires authentication at Contributor level or higher and can allow ar...

CVE-2024-29106

CVE-2024-29106 affects LeapWorx’s Leap13 Premium Addons for Elementor (WordPress Premium Addons for Elementor) up to version 4.10.16. The issue is an Improper Neutralization of Input During Web Page Generation, i.e., Stored XSS. Root cause: insufficient input sanitization in the affected plugin’s...

CVE-2024-5553

CVE-2024-5553 affects Premium Addons for Elementor for WordPress (versions up to and including 4.10.33). It is a DOM-Based Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can i...

CVE-2024-0376

CVE-2024-0376 affects the Premium Addons for Elementor plugin on WordPress. It enables Stored Cross-Site Scripting via the Wrapper Link Widget in all versions up to 4.10.16 due to insufficient input sanitization and output escaping of user‑provided URLs. Exploitation requires at least Contributor...

CVE-2024-6495

CVE-2024-6495 refers to a Stored DOM-based Cross-Site Scripting vulnerability in the Premium Addons for Elementor WordPress plugin (versions up to 4.10.36) due to insufficient input sanitization and output escaping in the Animated Text widget. Exploitation requires authenticated access (contribut...

CVE-2024-2666

CVE-2024-2666 affects the Premium Addons for Elementor plugin for WordPress. The Red Hat and initial CVE records describe a DOM-Based Stored Cross-Site Scripting vulnerability in the plugin’s Bullet List Widget, present in all versions up to and including 4.10.24. The issue stems from insufficien...

CVE-2021-24257

CVE-2021-24257 affects the WordPress plugin Premium Addons for Elementor prior to version 4.2.8. The issue is stored cross-site scripting (XSS) in multiple widgets accessible to low-privilege users (e.g., contributors). The OpenVAS and WPVulnDB entries provide concrete details, including widget-r...

CVE-2024-1680

CVE-2024-1680 refers to the Premium Addons for Elementor plugin for WordPress. Public sources (NVD/Red Hat/Wordfence) describe a Stored Cross-Site Scripting (XSS) vulnerability in the Image Settings URL of the Banner, Team Members, and Image Scroll widgets, present in all versions up to and inclu...

CVE-2024-8681

Consolidated findings for CVE-2024-8681 show that Premium Addons for Elementor (WordPress) allows Stored Cross-Site Scripting via the Media Grid widget in all versions up to 4.10.52. The underlying issue is insufficient input sanitization and output escaping on user-supplied attributes, enabling ...

CVE-2024-6824

CVE-2024-6824 affects Premium Addons for Elementor (WordPress). A missing capability check in check_temp_validity and update_template_title across all versions up to 4.10.38 allows authenticated attackers with Contributor-level access and above to delete arbitrary content and modify post/page tit...

CVE-2024-11937

CVE-2024-11937 affects Premium Addons for Elementor (WordPress). A stored Cross-Site Scripting flaw exists via the Mobile Menu element’s linkURL in all versions up to 4.10.69. Exploitation requires at least contributor-level authentication; successful abuse injects scripts that run when users vie...

CVE-2025-14155

Premium Addons for Elementor (WordPress)

CVE-2025-14163

CVE-2025-14163 : The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation in insert_inner_template. This enables unauthenticated attackers to forge requests and cause creation of arbitrary Elementor templates, by tricking a ...

CVE-2025-68494

The CVE-2025-68494 entry describes an information-disclosure vulnerability in the WordPress plugin “Premium Addons for Elementor” (Leap13 Premium Addons for Elementor) affecting versions up to and including 4.11.53. The flaw allows retrieval of embedded sensitive data via an exposure of sensitive...