https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-69092.htmlhttps://patchthecve.com/cve/CVE-2025-69092.htmlWed, 07 Oct 2026 11:10:00 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.https://patchthecve.com/cve/CVE-2025-64352.htmlhttps://patchthecve.com/cve/CVE-2025-64352.htmlWed, 17 Jun 2026 09:54:15 +0000LOW 2.7: Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.2.4.https://patchthecve.com/cve/CVE-2025-6244.htmlhttps://patchthecve.com/cve/CVE-2025-6244.htmlWed, 17 Jun 2026 10:01:27 +0000MEDIUM 6.4: The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outphttps://patchthecve.com/cve/CVE-2024-9994.htmlhttps://patchthecve.com/cve/CVE-2024-9994.htmlWed, 17 Jun 2026 08:25:39 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 duhttps://patchthecve.com/cve/CVE-2024-9993.htmlhttps://patchthecve.com/cve/CVE-2024-9993.htmlWed, 17 Jun 2026 08:25:39 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insuffichttps://patchthecve.com/cve/CVE-2025-24752.htmlhttps://patchthecve.com/cve/CVE-2025-24752.htmlWed, 17 Jun 2026 08:59:32 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14.https://patchthecve.com/cve/CVE-2025-39590.htmlhttps://patchthecve.com/cve/CVE-2025-39590.htmlWed, 17 Jun 2026 09:18:12 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.https://patchthecve.com/cve/CVE-2025-39589.htmlhttps://patchthecve.com/cve/CVE-2025-39589.htmlWed, 17 Jun 2026 09:18:12 +0000MEDIUM 4.3: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.https://patchthecve.com/cve/CVE-2024-56063.htmlhttps://patchthecve.com/cve/CVE-2024-56063.htmlWed, 17 Jun 2026 08:11:40 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7.https://patchthecve.com/cve/CVE-2024-8979.htmlhttps://patchthecve.com/cve/CVE-2024-8979.htmlWed, 17 Jun 2026 08:23:40 +0000HIGH 8.0: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' function. This makes it https://patchthecve.com/cve/CVE-2024-8978.htmlhttps://patchthecve.com/cve/CVE-2024-8978.htmlWed, 17 Jun 2026 08:23:40 +0000MEDIUM 5.7: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it posshttps://patchthecve.com/cve/CVE-2024-8961.htmlhttps://patchthecve.com/cve/CVE-2024-8961.htmlWed, 17 Jun 2026 08:23:38 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and ouhttps://patchthecve.com/cve/CVE-2021-4447.htmlhttps://patchthecve.com/cve/CVE-2021-4447.htmlWed, 17 Jun 2026 04:19:46 +0000HIGH 8.8: The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers withhttps://patchthecve.com/cve/CVE-2021-4446.htmlhttps://patchthecve.com/cve/CVE-2021-4446.htmlWed, 17 Jun 2026 04:19:46 +0000MEDIUM 6.3: The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform manhttps://patchthecve.com/cve/CVE-2024-8742.htmlhttps://patchthecve.com/cve/CVE-2024-8742.htmlWed, 17 Jun 2026 08:23:13 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization ahttps://patchthecve.com/cve/CVE-2024-8440.htmlhttps://patchthecve.com/cve/CVE-2024-8440.htmlWed, 17 Jun 2026 08:22:34 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaphttps://patchthecve.com/cve/CVE-2024-7092.htmlhttps://patchthecve.com/cve/CVE-2024-7092.htmlWed, 17 Jun 2026 08:19:20 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘no_more_items_text’ parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output https://patchthecve.com/cve/CVE-2024-39649.htmlhttps://patchthecve.com/cve/CVE-2024-39649.htmlWed, 17 Jun 2026 07:42:23 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite.This issue affects Essential Addons for Elementor: from n/a through <= 5.9.26.https://patchthecve.com/cve/CVE-2024-5189.htmlhttps://patchthecve.com/cve/CVE-2024-5189.htmlWed, 17 Jun 2026 08:15:22 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping.https://patchthecve.com/cve/CVE-2024-5612.htmlhttps://patchthecve.com/cve/CVE-2024-5612.htmlWed, 17 Jun 2026 08:16:17 +0000MEDIUM 6.4: The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_icon’ parameter within the Lightbox & Modal widget in all versions up to, and including, 5.8.15 due to insufficient input sanitization and output escaping. This mahttps://patchthecve.com/cve/CVE-2024-5188.htmlhttps://patchthecve.com/cve/CVE-2024-5188.htmlWed, 17 Jun 2026 08:15:22 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and https://patchthecve.com/cve/CVE-2024-5073.htmlhttps://patchthecve.com/cve/CVE-2024-5073.htmlWed, 17 Jun 2026 08:15:07 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input sanitization and output escapinghttps://patchthecve.com/cve/CVE-2024-5086.htmlhttps://patchthecve.com/cve/CVE-2024-5086.htmlWed, 17 Jun 2026 08:15:09 +0000MEDIUM 6.4: The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team Member Carousel widget in all Pro versions up to, and including, 5.8.14 due to insufficient input sanitizatihttps://patchthecve.com/cve/CVE-2023-41955.htmlhttps://patchthecve.com/cve/CVE-2023-41955.htmlWed, 17 Jun 2026 06:23:08 +0000HIGH 8.8: Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.https://patchthecve.com/cve/CVE-2024-4624.htmlhttps://patchthecve.com/cve/CVE-2024-4624.htmlWed, 17 Jun 2026 08:02:17 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and outputhttps://patchthecve.com/cve/CVE-2024-4449.htmlhttps://patchthecve.com/cve/CVE-2024-4449.htmlWed, 17 Jun 2026 08:01:54 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Fancy Text', 'Filter Gallery', 'Sticky Video', 'Content Ticker', 'Woo Product Gallery', & 'Twitter Feed' widgets in https://patchthecve.com/cve/CVE-2024-4448.htmlhttps://patchthecve.com/cve/CVE-2024-4448.htmlWed, 17 Jun 2026 08:01:54 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.19 dhttps://patchthecve.com/cve/CVE-2024-4275.htmlhttps://patchthecve.com/cve/CVE-2024-4275.htmlWed, 17 Jun 2026 08:01:34 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Interactive Circle widget in all versions up to, and including, 5.9.19 due to insufficient input sanitization and outhttps://patchthecve.com/cve/CVE-2024-4156.htmlhttps://patchthecve.com/cve/CVE-2024-4156.htmlWed, 17 Jun 2026 08:01:14 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output ehttps://patchthecve.com/cve/CVE-2024-4003.htmlhttps://patchthecve.com/cve/CVE-2024-4003.htmlWed, 17 Jun 2026 08:00:55 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_team_members_image_rounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to insufhttps://patchthecve.com/cve/CVE-2024-3728.htmlhttps://patchthecve.com/cve/CVE-2024-3728.htmlWed, 17 Jun 2026 07:44:53 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery & Interactive Circle widgets in all versions up to, and including, 5.9.15 due to insufficient inpuhttps://patchthecve.com/cve/CVE-2024-3645.htmlhttps://patchthecve.com/cve/CVE-2024-3645.htmlWed, 17 Jun 2026 07:44:43 +0000MEDIUM 6.4: The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Counter widget in all versions up to, and including, 5.8.11 due to insufficient input sanitization and output escaping on user supplied attributes such as 'title_html_tag'. This https://patchthecve.com/cve/CVE-2024-3333.htmlhttps://patchthecve.com/cve/CVE-2024-3333.htmlWed, 17 Jun 2026 07:43:47 +0000MEDIUM 6.4: The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in all versions up to, and including, 5.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authehttps://patchthecve.com/cve/CVE-2024-2974.htmlhttps://patchthecve.com/cve/CVE-2024-2974.htmlWed, 17 Jun 2026 07:25:56 +0000MEDIUM 5.3: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.9.13 via the load_more function. This can allow unauthenticated attackers to extract sensitive https://patchthecve.com/cve/CVE-2024-2650.htmlhttps://patchthecve.com/cve/CVE-2024-2650.htmlWed, 17 Jun 2026 07:24:58 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the alignment parameter in the Woo Product Carousel widget in all versions up to, and including, 5.9.10 due to insufficient input https://patchthecve.com/cve/CVE-2024-2623.htmlhttps://patchthecve.com/cve/CVE-2024-2623.htmlWed, 17 Jun 2026 07:24:54 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization and ohttps://patchthecve.com/cve/CVE-2024-3018.htmlhttps://patchthecve.com/cve/CVE-2024-3018.htmlWed, 17 Jun 2026 07:43:08 +0000HIGH 8.8: The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possibhttps://patchthecve.com/cve/CVE-2024-1537.htmlhttps://patchthecve.com/cve/CVE-2024-1537.htmlWed, 17 Jun 2026 07:04:27 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Data Table widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaphttps://patchthecve.com/cve/CVE-2024-1536.htmlhttps://patchthecve.com/cve/CVE-2024-1536.htmlWed, 17 Jun 2026 07:04:26 +0000HIGH 7.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output ehttps://patchthecve.com/cve/CVE-2024-1276.htmlhttps://patchthecve.com/cve/CVE-2024-1276.htmlWed, 17 Jun 2026 07:03:52 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Content Ticker arrow attribute in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output ehttps://patchthecve.com/cve/CVE-2024-1236.htmlhttps://patchthecve.com/cve/CVE-2024-1236.htmlWed, 17 Jun 2026 07:03:47 +0000MEDIUM 6.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to insufficient input sanitization anhttps://patchthecve.com/cve/CVE-2024-1172.htmlhttps://patchthecve.com/cve/CVE-2024-1172.htmlWed, 17 Jun 2026 07:03:37 +0000MEDIUM 5.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion widget in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escapihttps://patchthecve.com/cve/CVE-2024-1171.htmlhttps://patchthecve.com/cve/CVE-2024-1171.htmlWed, 17 Jun 2026 07:03:37 +0000MEDIUM 5.4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget in all versions up to, and including, 5.9.8 due to insufficient input sanitization and outp