sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total39
Critical0
High1
Medium37
Reset
Showing 1-20 of 39 records
Threat Entry Updated 2026-07-14

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2026-12141)

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_tooltip_text' parameter in all versions up to, and including, 4.11.84 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is specifically triggered when an administrator or higher-privileged user opens the affected post in the Elementor editor, as…

PLUGIN Premium Addons For Elementor

CVE-2026-12141

MEDIUM CVSS 4.9 2026-07-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons for Elementor - Cross-Site Scripting (XSS) (CVE-2026-4790)

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_svg' parameter in versions up to, and including, 4.11.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons for Elementor

CVE-2026-4790

MEDIUM CVSS 5.4 2026-05-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Broken Access Control (CVE-2025-14155)

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.

PLUGIN Premium Addons For Elementor

CVE-2025-14155

MEDIUM CVSS 5.3 2025-12-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Request Forgery (CSRF) (CVE-2025-14163)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insert_inner_template' function. This makes it possible for unauthenticated attackers to create arbitrary Elementor templates via a forged request granted they can trick a site administrator or other user with the edit_posts capability into performing an action such as clicking on a link.

PLUGIN Premium Addons For Elementor

CVE-2025-14163

MEDIUM CVSS 4.3 2025-12-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-11937)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons For Elementor

CVE-2024-11937

MEDIUM CVSS 6.4 2025-07-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2025-4774)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons For Elementor

CVE-2025-4774

MEDIUM CVSS 6.4 2025-06-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-10266)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons For Elementor

CVE-2024-10266

MEDIUM CVSS 6.4 2024-10-29
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Security Vulnerability (CVE-2021-4445)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.

PLUGIN Premium Addons For Elementor

CVE-2021-4445

MEDIUM CVSS 6.5 2024-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-8681)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all versions up to, and including, 4.10.52 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons For Elementor

CVE-2024-8681

MEDIUM CVSS 6.4 2024-09-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Broken Access Control (CVE-2024-6824)

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'check_temp_validity' and 'update_template_title' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles.

PLUGIN Premium Addons For Elementor

CVE-2024-6824

MEDIUM CVSS 4.3 2024-08-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-6495)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons For Elementor

CVE-2024-6495

MEDIUM CVSS 6.4 2024-07-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Denial of Service (CVE-2024-6434)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources.

PLUGIN Premium Addons For Elementor

CVE-2024-6434

LOW CVSS 3.1 2024-07-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-6340)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.10.36 and fully patched in version 4.10.37.

PLUGIN Premium Addons For Elementor

CVE-2024-6340

MEDIUM CVSS 6.4 2024-07-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-5553)

The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all versions up to, and including, 4.10.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses and edits an injected element, and subsequently clicks the element with the mouse scroll wheel.

PLUGIN Premium Addons For Elementor

CVE-2024-5553

MEDIUM CVSS 4.4 2024-06-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-4376)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While 4.10.32 is patched, it is recommended to update to 4.10.33 because 4.10.32 caused a fatal error.

PLUGIN Premium Addons For Elementor

CVE-2024-4376

MEDIUM CVSS 6.4 2024-05-31
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Premium Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2024-4379)

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Premium Addons For Elementor

CVE-2024-4379

MEDIUM CVSS 5.4 2024-05-31
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.