Threat Entry Updated 2026-04-15

CVE-2026-1004 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.

PLUGIN Essential Addons For Elementor Lite

CVE-2026-1004

MEDIUM CVSS 5.3 2026-01-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-12-18

CVE-2025-13977 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2025-13977

MEDIUM CVSS 6.4 2025-12-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-08-15

CVE-2025-8451 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2025-8451

MEDIUM CVSS 6.4 2025-08-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-03

CVE-2024-5647 - Essential Addons For Elementor Lite Plugin

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-5647

MEDIUM CVSS 6.4 2025-07-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-14

CVE-2024-9994 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-9994

MEDIUM CVSS 6.4 2025-06-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-14

CVE-2024-9993 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-9993

MEDIUM CVSS 6.4 2025-06-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-8979 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including usernames and passwords of any user, including Administrators, as long as that user opens the email notification for a password change request and images are not blocked by the email client.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-8979

HIGH CVSS 8.0 2024-11-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-8978 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Login | Register Form widget, as long as that user opens the email notification for successful registration.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-8978

MEDIUM CVSS 5.7 2024-11-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-8961 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-8961

MEDIUM CVSS 6.4 2024-11-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-09-27

CVE-2024-8742 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-8742

MEDIUM CVSS 6.4 2024-09-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-09-25

CVE-2024-8440 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-8440

MEDIUM CVSS 6.4 2024-09-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-7092 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘no_more_items_text’ parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-7092

MEDIUM CVSS 6.4 2024-08-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-15

CVE-2024-5189 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-5189

MEDIUM CVSS 6.4 2024-06-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-5188 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-5188

MEDIUM CVSS 6.4 2024-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-15

CVE-2024-5073 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-5073

MEDIUM CVSS 6.4 2024-05-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-15

CVE-2024-4624 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-4624

MEDIUM CVSS 6.4 2024-05-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-15

CVE-2024-4156 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-4156

MEDIUM CVSS 6.4 2024-05-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-2623 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-2623

MEDIUM CVSS 6.4 2024-04-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-1276 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Content Ticker arrow attribute in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-1276

MEDIUM CVSS 6.4 2024-02-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-1236 - Essential Addons For Elementor Lite Plugin

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Essential Addons For Elementor Lite

CVE-2024-1236

MEDIUM CVSS 6.4 2024-02-29

Risk Score

Open Full Technical Breakdown