https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-8100.htmlhttps://patchthecve.com/cve/CVE-2025-8100.htmlWed, 17 Jun 2026 10:06:18 +0000MEDIUM 5.4: The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,https://patchthecve.com/cve/CVE-2025-5944.htmlhttps://patchthecve.com/cve/CVE-2025-5944.htmlWed, 17 Jun 2026 09:49:04 +0000MEDIUM 6.4: The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cohttps://patchthecve.com/cve/CVE-2025-1458.htmlhttps://patchthecve.com/cve/CVE-2025-1458.htmlWed, 17 Jun 2026 08:39:10 +0000MEDIUM 6.4: The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficiehttps://patchthecve.com/cve/CVE-2024-12851.htmlhttps://patchthecve.com/cve/CVE-2024-12851.htmlWed, 17 Jun 2026 07:00:38 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to insuffhttps://patchthecve.com/cve/CVE-2024-11852.htmlhttps://patchthecve.com/cve/CVE-2024-11852.htmlWed, 17 Jun 2026 06:58:35 +0000MEDIUM 4.3: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes ithttps://patchthecve.com/cve/CVE-2024-9058.htmlhttps://patchthecve.com/cve/CVE-2024-9058.htmlWed, 17 Jun 2026 08:23:52 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lightbox widget in all versions up to, and including, 5.10.5 due to insufficient input sanitization and output escapinhttps://patchthecve.com/cve/CVE-2024-10980.htmlhttps://patchthecve.com/cve/CVE-2024-10980.htmlWed, 17 Jun 2026 06:56:49 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow ushttps://patchthecve.com/cve/CVE-2024-10493.htmlhttps://patchthecve.com/cve/CVE-2024-10493.htmlWed, 17 Jun 2026 06:55:47 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the conthttps://patchthecve.com/cve/CVE-2024-9867.htmlhttps://patchthecve.com/cve/CVE-2024-9867.htmlWed, 17 Jun 2026 08:25:24 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Open Map Widget' marker_content parameter in all versions up to, and including, 5.10.2 due to insufficient input sanihttps://patchthecve.com/cve/CVE-2024-9657.htmlhttps://patchthecve.com/cve/CVE-2024-9657.htmlWed, 17 Jun 2026 08:24:59 +0000MEDIUM 6.5: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip' parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output eschttps://patchthecve.com/cve/CVE-2024-9868.htmlhttps://patchthecve.com/cve/CVE-2024-9868.htmlWed, 17 Jun 2026 08:25:24 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization anhttps://patchthecve.com/cve/CVE-2024-10310.htmlhttps://patchthecve.com/cve/CVE-2024-10310.htmlWed, 17 Jun 2026 06:55:23 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Widget 'image_title' parameter in all versions up to, and including, 5.10.1 due to insufficient input shttps://patchthecve.com/cve/CVE-2024-47392.htmlhttps://patchthecve.com/cve/CVE-2024-47392.htmlWed, 17 Jun 2026 07:57:01 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through <= 5.7.5.https://patchthecve.com/cve/CVE-2024-7247.htmlhttps://patchthecve.com/cve/CVE-2024-7247.htmlWed, 17 Jun 2026 08:19:41 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Gallery and Countdown widgets in all versions up to, and including, 5.7.2 due to insufficient input sahttps://patchthecve.com/cve/CVE-2024-4360.htmlhttps://patchthecve.com/cve/CVE-2024-4360.htmlWed, 17 Jun 2026 08:01:44 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escapinhttps://patchthecve.com/cve/CVE-2024-4359.htmlhttps://patchthecve.com/cve/CVE-2024-4359.htmlWed, 17 Jun 2026 08:01:44 +0000MEDIUM 6.5: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. Thttps://patchthecve.com/cve/CVE-2024-4643.htmlhttps://patchthecve.com/cve/CVE-2024-4643.htmlWed, 17 Jun 2026 08:02:19 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘end_redirect_link’ parameter in versions up to, and including, 5.7.1 due to insufficient input sanitization and outpuhttps://patchthecve.com/cve/CVE-2024-39667.htmlhttps://patchthecve.com/cve/CVE-2024-39667.htmlWed, 17 Jun 2026 07:42:25 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.6.11.https://patchthecve.com/cve/CVE-2024-2455.htmlhttps://patchthecve.com/cve/CVE-2024-2455.htmlWed, 17 Jun 2026 07:24:34 +0000MEDIUM 6.4: The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thttps://patchthecve.com/cve/CVE-2024-5555.htmlhttps://patchthecve.com/cve/CVE-2024-5555.htmlWed, 17 Jun 2026 08:16:11 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘social-link-title’ parameter in all versions up to, and including, 5.6.5 due to insufficient input sanitization and ohttps://patchthecve.com/cve/CVE-2024-5554.htmlhttps://patchthecve.com/cve/CVE-2024-5554.htmlWed, 17 Jun 2026 08:16:11 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘onclick_event’ parameter in all versions up to, and including, 5.6.11 due to insufficient input sanitization and outphttps://patchthecve.com/cve/CVE-2024-3925.htmlhttps://patchthecve.com/cve/CVE-2024-3925.htmlWed, 17 Jun 2026 07:45:29 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.11 due to insufficient input sanitization an