WordPress premium-addons-for-elementor has 28 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-14155 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data | medium | 5.3 | <4.11.54 | 4.11.54 |
| CVE-2024-0376 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Wrapper Link Widget in a | medium | 6.4 | <=4.10.16 | – |
| CVE-2024-0326 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionali | medium | 6.4 | <4.10.18 | 4.10.18 |
| CVE-2021-24257 | The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS | medium | 5.4 | <4.2.8 | 4.2.8 |
| CVE-2024-6434 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, a | low | 3.1 | <4.10.36 | 4.10.36 |
| CVE-2024-4203 | The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions u | medium | 5.4 | <4.10.31 | 4.10.31 |
| CVE-2024-2665 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button in all versions u | medium | 6.4 | <4.10.28 | 4.10.28 |
| CVE-2024-2664 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all | medium | 6.4 | <4.10.25 | 4.10.25 |
| CVE-2024-2666 | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Wi | medium | 5.4 | <4.10.25 | 4.10.25 |
| CVE-2024-3647 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post ticker widget in al | medium | 6.4 | <4.10.29 | 4.10.29 |
| CVE-2024-1680 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, | medium | 6.4 | <4.10.22 | 4.10.22 |
| CVE-2024-3885 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in a | medium | 6.4 | <4.10.29 | 4.10.29 |
| CVE-2021-4445 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. Thi | medium | 6.5 | <4.5.2 | 4.5.2 |
| CVE-2024-8681 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all | medium | 6.4 | <4.10.53 | 4.10.53 |
| CVE-2024-6824 | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capabilit | medium | 4.3 | <4.10.39 | 4.10.39 |
| CVE-2024-1242 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all v | medium | 6.4 | <4.10.19 | 4.10.19 |
| CVE-2024-2399 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions | medium | 6.4 | <4.10.24 | 4.10.24 |
| CVE-2024-5553 | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all v | medium | 4.4 | <4.10.34 | 4.10.34 |
| CVE-2024-6340 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all | medium | 6.4 | <4.10.36 | 4.10.36 |
| CVE-2024-4205 | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the | medium | 4.3 | <4.10.32 | 4.10.32 |
| CVE-2024-4376 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all | medium | 6.4 | <4.10.32 | 4.10.32 |
| CVE-2024-4378 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets i | medium | 6.4 | <4.10.32 | 4.10.32 |
| CVE-2024-4379 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in | medium | 5.4 | <4.10.32 | 4.10.32 |
| CVE-2024-6495 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in | medium | 6.4 | <4.10.37 | 4.10.37 |
| CVE-2024-10266 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all | medium | 6.4 | <4.10.61 | 4.10.61 |
| CVE-2025-4774 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Count | medium | 6.4 | <4.11.9 | 4.11.9 |
| CVE-2024-11937 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Me | medium | 6.4 | <4.10.70 | 4.10.70 |
| CVE-2025-14163 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11 | medium | 4.3 | <4.11.54 | 4.11.54 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked