CVE-2024-2203: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticate

medium Affects the-plus-addons-for-elementor-page-builder (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-03-27; advisory modified 2026-06-17.

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticate

Package: the-plus-addons-for-elementor-page-builder (WordPress plugin) WordPress
Affected versions: <5.4.2
Fixed in: 5.4.2
Severity: medium CVSS 6.4
Exploitation: not on CISA KEV · EPSS 1% (48.3th percentile)
Published: 2024-03-27
Source: nvd

References

CWE-22

NVD record the-plus-addons-for-elementor-page-builder (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-4331 high The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation i same package: the-plus-addons-for-elementor-page-builder (WordPress plugin)
CVE-2021-4332 medium The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads i same package: the-plus-addons-for-elementor-page-builder (WordPress plugin)
CVE-2024-4484 medium The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, same package: the-plus-addons-for-elementor-page-builder (WordPress plugin)
CVE-2024-0445 medium The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site same package: the-plus-addons-for-elementor-page-builder (WordPress plugin)
CVE-2024-3199 medium The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site same package: the-plus-addons-for-elementor-page-builder (WordPress plugin)
CVE-2024-2210 medium The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusi same package: the-plus-addons-for-elementor-page-builder (WordPress plugin)