WordPress addon-elements-for-elementor-page-builder has 20 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-1358 | The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the | high | 8.8 | <1.13 | 1.13 |
| CVE-2023-4723 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 v | medium | 5.3 | <=1.12.7 | – |
| CVE-2024-3743 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group, Shape Separator, C | medium | 6.4 | <1.13.4 | 1.13.4 |
| CVE-2024-13215 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | <1.14 | 1.14 |
| CVE-2024-0834 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up | medium | 6.4 | <=1.12.11 | – |
| CVE-2024-2091 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up t | medium | 5.4 | <1.13.3 | 1.13.3 |
| CVE-2024-1392 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual | medium | 6.4 | <1.13 | 1.13 |
| CVE-2024-1391 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribu | medium | 6.4 | <1.13 | 1.13 |
| CVE-2024-1393 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content | medium | 6.4 | <1.13 | 1.13 |
| CVE-2024-1422 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting i | medium | 6.4 | <1.13 | 1.13 |
| CVE-2024-2792 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in all versions up to, and includ | medium | 6.4 | <1.13.3 | 1.13.3 |
| CVE-2023-5381 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and inc | medium | 4.4 | <=1.12.7 | – |
| CVE-2024-7122 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, a | medium | 6.4 | <1.13.7 | 1.13.7 |
| CVE-2024-8902 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | <1.13.9 | 1.13.9 |
| CVE-2024-4569 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, an | medium | 6.4 | <1.13.6 | 1.13.6 |
| CVE-2024-4401 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' param | medium | 6.4 | <1.13.6 | 1.13.6 |
| CVE-2024-4570 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, an | medium | 6.4 | <1.13.6 | 1.13.6 |
| CVE-2024-2092 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versio | medium | 5.4 | <1.13.4 | 1.13.4 |
| CVE-2023-4689 | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | <=1.12.7 | – |
| CVE-2023-4690 | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This | medium | 5.4 | <=1.12.7 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked