CVE-2021-24175

The CVE-2021-24175 entry concerns The Plus Addons for Elementor Page Builder WordPress plugin, affecting versions before 4.1.7. Concretely, affected functionality allowed unauthenticated attackers to bypass authentication, log in as any user (including admin) by supplying a username, and create a...

CVE-2023-47178

CVE-2023-47178 describes an unauthenticated Local File Inclusion (path traversal) vulnerability in The Plus Addons for Elementor Pro. Affected versions are up to and including 5.2.8 (the patch to fix is 5.2.9). The issue arises from improper limitation of a pathname to a restricted directory, ena...

CVE-2021-24358

WordPress Plus Addons for Elementor Page Builder prior to 4.1.10 is vulnerable to an Open Redirect when a crafted URL is used to pass an unvalidated redirect parameter. The issue arises from failing to validate the redirect target before redirecting, enabling potential abuse for phishing or to le...

CVE-2024-2785

CVE-2024-2785 affects The Plus Addons for Elementor (WordPress). The issue is a Stored Cross-Site Scripting (XSS) in the Age Gate widget due to insufficient input sanitization and output escaping of user-supplied attributes. Affected versions are ≤ 5.4.2. Exploitation requires contributor-level a...

CVE-2021-24351

The CVE-2021-24351 entry corresponds to a reflected Cross-Site Scripting vulnerability in WordPress The Plus Addons for Elementor Page Builder plugin, affecting versions before 4.1.12. The issue arises in the theplus_more_post AJAX action, where some fields are not properly sanitized, allowing un...

CVE-2024-0445

CVE-2024-0445 concerns WordPress plugin The Plus Addons for Elementor Page Builder. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to 5.4.2, caused by insufficient input sanitization and output escaping in the plugin’s element attributes. Exploitati...

CVE-2024-53823

CVE-2024-53823 involves a DOM-based cross-site scripting (XSS) vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite (WordPress plugin). The root cause is improper neutralization of input during web page generation, enabling XSS in affected pages. Affected software: The Plus A...

CVE-2024-43932

CVE-2024-43932 is a Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite. The issue arises from incorrectly configured access control security levels, allowing unauthorized actions. Affected: The Plus Addons for Elementor Page Builder Lite up to version ...

CVE-2024-5455

CVE-2024-5455 affects The Plus Addons for Elementor Page Builder (WordPress). It allows Local File Inclusion via magazine_style in the Dynamic Smart Showcase widget, enabling authenticated attackers with Contributor+ access to include/execute arbitrary PHP files. Affected versions are up to 5.5.4...

CVE-2024-4983

CVE-2024-4983 concerns The Plus Addons for Elementor (The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce) with Stored Cross-Site Scripting via the video_color parameter in all versions up to and including 5.6.0. The root cause is insufficient input s...

CVE-2024-2203

CVE-2024-2203 : The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 5.4.1 via the Clients widget. Authenticated users with contributor-level access and above can include and execute arbitrary PHP files on the server, enablin...

CVE-2024-2210

The CVE-2024-2210 entry pertains to The Plus Addons for Elementor WordPress plugin. It enables Local File Inclusion via the Team Member Listing widget in all versions up to 5.4.1, allowing authenticated users with contributor privileges or higher to include and execute arbitrary PHP code from ser...

CVE-2024-1419

The Plus Addons for Elementor Page Builder for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Header Meta Content widget via the _id attribute, affecting all versions up to and including 5.4.0. Exploitation requires authenticated access at contributor level or higher,...

CVE-2021-24949

The CVE-2021-24949 concerns The Plus Addons for Elementor Pro WordPress plugin (pre-5.0.7). The WP Search Filters widget fails to sanitise and escape the option parameter before using it in a SQL statement, enabling unauthenticated SQL injection. Affected product: The Plus Addons for Elementor Pr...

CVE-2025-1287

CVE-2025-1287 concerns The Plus Addons for Elementor Page Builder Lite (and related The Plus Addons for Elementor) for WordPress. Affected: plugins in versions up to and including 6.2.2. Root cause: stored XSS via Countdown, Syntax Highlighter, and Page Scroll widgets caused by insufficient input...

CVE-2021-24359

The CVE-2021-24359 issue affects the Plus Addons for Elementor Page Builder WordPress plugin prior to version 4.1.11. The vulnerability allows an attacker to abuse a password-reset request to send an arbitrary reset email to a registered user, potentially enabling account takeover when combined w...

CVE-2024-34373

The CVE-2024-34373 vulnerability is a Stored Cross-Site Scripting issue in POSIMYTH The Plus Addons for Elementor Page Builder Lite, affecting all versions up to 5.4.2. Root cause: improper neutralization of input during web page generation. Impact: stored scripts could execute in a user’s browse...

CVE-2024-5341

CVE-2024-5341 affects The Plus Addons for Elementor Page Builder (WordPress). The vulnerability is a Stored XSS via the 'size' attribute of the Heading Title widget, allowing authenticated users with contributor-level access or higher to inject scripts that execute when pages are viewed. Affected...

CVE-2024-4482

CVE-2024-4482 : The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is affected by Stored Cross-Site Scripting via the Countdown widget. Root cause: insufficient input sanitization and output escaping on the user-supplied text_day...

CVE-2024-43977

The CVE-2024-43977 entry describes a Stored XSS in POSIMYTH The Plus Addons for Elementor Page Builder Lite (WordPress). Affected: The Plus Addons for Elementor Page Builder Lite versions n/a through 5.6.2. Cause: Improper neutralization of input during web page generation. Impact: Stored XSS vul...

CVE-2024-4484

CVE-2024-4484 affects The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce (WordPress). It is a Stored Cross-Site Scripting vulnerability via the xai_username parameter in versions up to and including 5.5.2, caused by insufficient input sanitization an...

CVE-2024-6575

The Plus Addons for Elementor (The Plus Addons for Elementor Page Builder) contains a Stored Cross‑Site Scripting (Stored XSS) flaw in the tp_page_scroll widget via the res_width_value parameter. Affected versions include all up to and including 5.6.2. Exploitation requires authentication at Cont...

CVE-2024-2784

The CVE CVE-2024-2784 affects The Plus Addons for Elementor (WordPress). It is a Stored Cross-Site Scripting vulnerability in the Hover Card widget present in versions up to 5.5.4, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires aut...

CVE-2024-10365

Summary: CVE-2024-10365 affects The Plus Addons for Elementor (WordPress plugin) up to version 6.0.3 and causes Sensitive Information Exposure via the render function used by multiple widgets (e.g., tp_carousel_anything.php, tp_page_scroll.php). Impact: authenticated attackers with Contributor-le...

CVE-2024-3199

CVE-2024-3199 (The Plus Addons for Elementor) Details: Authenticated attackers (Contributor+ or higher) can exploit a stored XSS via the Countdown widget in The Plus Addons for Elementor, affecting all versions up to 5.4.2 due to insufficient input sanitization and output escaping. Connected sour...

CVE-2024-3718

CVE-2024-3718 (The Plus Addons for Elementor) is a Stored Cross‑Site Scripting vulnerability in The Plus Addons for Elementor

CVE-2024-35709

CVE-2024-35709 is a Stored XSS vulnerability in WordPress The Plus Addons for Elementor Page Builder Lite (versions up to and including 5.5.4). The issue stems from improper input neutralization during web page generation, enabling stored XSS. Affected product: The Plus Addons for Elementor Page ...

CVE-2024-4485

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin exposes a stored cross-site scripting (XSS) flaw via the button_custom_attributes parameter in versions up to 5.5.2 due to insufficient input sanitization and output escaping. Exploitation req...

CVE-2024-5583

The Plus Addons for Elementor (WordPress) has CVE-2024-5583: Stored XSS via the testimonials widget’s carousel_direction attribute in all versions up to and including 5.6.2. Affected product: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce. Root c...

CVE-2024-5763

The Plus Addons for Elementor (plugin for WordPress)

CVE-2024-8913

CVE-2024-8913 affects The Plus Addons for Elementor (WordPress) up to version 5.6.11. The issue arises from the render function in modules/widgets/tp_accordion.php, enabling authenticated attackers with Contributor-level access and above to expose sensitive information (private, pending, and draf...

CVE-2024-5344

The Plus Addons for Elementor Page Builder plugin for WordPress has a Reflected XSS vulnerability (CVE-2024-5344) in the WP Login & Register widget via the forgoturl attribute across all versions up to 5.5.6. An unauthenticated attacker can inject scripts that execute in pages a user visits after...

CVE-2024-11829

CVE-2024-11829 — The Plus Addons for Elementor Page Builder (WordPress) is affected by a Stored Cross-Site Scripting (XSS) via the Table Widget’s searchable_label parameter in all versions up to and including 6.1.8. An attacker with Contributor-level access or higher can inject arbitrary scripts ...

CVE-2021-24948

The CVE affects The Plus Addons for Elementor Pro (WordPress) up to version 5.0.6. The tp_get_dl_post_info_ajax action does not validate the qvquery parameter, allowing unauthenticated users to retrieve sensitive data such as private and draft posts. Public CVSS metrics indicate high impact (CVSS...

CVE-2024-3197

CVE-2024-3197 is a stored XSS vulnerability in The Plus Addons for Elementor (WordPress) up to version 5.4.2, caused by insufficient sanitization/escaping of user-provided attributes in widget configuration. Authenticated attackers with contributor-level access or higher can inject scripts that e...

CVE-2021-4331

CVE-2021-4331 – Plus Addons for Elementor (WordPress) is a privilege-escalation flaw in versions up to 4.1.9 (pro) and 2.0.6 (free). The plugin’s registration form exposes the default user role setting to lower-privilege users (e.g., contributors) who can select administrator as default, enabling...

CVE-2021-4332

The CVE-2021-4332 entry concerns the WordPress plugin Plus Addons for Elementor. Affected versions are Pro up to 4.1.9 and free up to 2.0.6. The vulnerability is an arbitrary file read caused by the plugin using file_get_contents on an SVG file without validating the file type, allowing a user wi...