https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-8100.htmlhttps://patchthecve.com/cve/CVE-2025-8100.htmlWed, 17 Jun 2026 10:06:18 +0000MEDIUM 5.4: The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,https://patchthecve.com/cve/CVE-2025-5944.htmlhttps://patchthecve.com/cve/CVE-2025-5944.htmlWed, 17 Jun 2026 09:49:04 +0000MEDIUM 6.4: The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cohttps://patchthecve.com/cve/CVE-2025-2168.htmlhttps://patchthecve.com/cve/CVE-2025-2168.htmlWed, 17 Jun 2026 09:06:27 +0000MEDIUM 4.3: The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce https://patchthecve.com/cve/CVE-2025-1458.htmlhttps://patchthecve.com/cve/CVE-2025-1458.htmlWed, 17 Jun 2026 08:39:10 +0000MEDIUM 6.4: The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficiehttps://patchthecve.com/cve/CVE-2024-12043.htmlhttps://patchthecve.com/cve/CVE-2024-12043.htmlWed, 17 Jun 2026 06:58:56 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'social_link_title' parameter of the 'blog' widget in all versions up to, and including, 3.16.5 due to insufficienhttps://patchthecve.com/cve/CVE-2024-12851.htmlhttps://patchthecve.com/cve/CVE-2024-12851.htmlWed, 17 Jun 2026 07:00:38 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to insuffhttps://patchthecve.com/cve/CVE-2024-11852.htmlhttps://patchthecve.com/cve/CVE-2024-11852.htmlWed, 17 Jun 2026 06:58:35 +0000MEDIUM 4.3: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes ithttps://patchthecve.com/cve/CVE-2024-9058.htmlhttps://patchthecve.com/cve/CVE-2024-9058.htmlWed, 17 Jun 2026 08:23:52 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lightbox widget in all versions up to, and including, 5.10.5 due to insufficient input sanitization and output escapinhttps://patchthecve.com/cve/CVE-2024-10980.htmlhttps://patchthecve.com/cve/CVE-2024-10980.htmlWed, 17 Jun 2026 06:56:49 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow ushttps://patchthecve.com/cve/CVE-2024-10493.htmlhttps://patchthecve.com/cve/CVE-2024-10493.htmlWed, 17 Jun 2026 06:55:47 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the conthttps://patchthecve.com/cve/CVE-2024-8442.htmlhttps://patchthecve.com/cve/CVE-2024-8442.htmlWed, 17 Jun 2026 08:22:35 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on uhttps://patchthecve.com/cve/CVE-2024-9867.htmlhttps://patchthecve.com/cve/CVE-2024-9867.htmlWed, 17 Jun 2026 08:25:24 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Open Map Widget' marker_content parameter in all versions up to, and including, 5.10.2 due to insufficient input sanihttps://patchthecve.com/cve/CVE-2024-9657.htmlhttps://patchthecve.com/cve/CVE-2024-9657.htmlWed, 17 Jun 2026 08:24:59 +0000MEDIUM 6.5: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip' parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output eschttps://patchthecve.com/cve/CVE-2024-9868.htmlhttps://patchthecve.com/cve/CVE-2024-9868.htmlWed, 17 Jun 2026 08:25:24 +0000MEDIUM 5.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization anhttps://patchthecve.com/cve/CVE-2024-10310.htmlhttps://patchthecve.com/cve/CVE-2024-10310.htmlWed, 17 Jun 2026 06:55:23 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Widget 'image_title' parameter in all versions up to, and including, 5.10.1 due to insufficient input shttps://patchthecve.com/cve/CVE-2024-47392.htmlhttps://patchthecve.com/cve/CVE-2024-47392.htmlWed, 17 Jun 2026 07:57:01 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through <= 5.7.5.https://patchthecve.com/cve/CVE-2024-8030.htmlhttps://patchthecve.com/cve/CVE-2024-8030.htmlWed, 17 Jun 2026 08:21:43 +0000CRITICAL 9.8: The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_wishlist cookie in versions up to , and https://patchthecve.com/cve/CVE-2024-5335.htmlhttps://patchthecve.com/cve/CVE-2024-5335.htmlWed, 17 Jun 2026 08:15:43 +0000CRITICAL 9.8: The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_compare_products cookie in versions up thttps://patchthecve.com/cve/CVE-2024-43342.htmlhttps://patchthecve.com/cve/CVE-2024-43342.htmlWed, 17 Jun 2026 07:50:50 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.4.https://patchthecve.com/cve/CVE-2024-7247.htmlhttps://patchthecve.com/cve/CVE-2024-7247.htmlWed, 17 Jun 2026 08:19:41 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Gallery and Countdown widgets in all versions up to, and including, 5.7.2 due to insufficient input sahttps://patchthecve.com/cve/CVE-2024-4360.htmlhttps://patchthecve.com/cve/CVE-2024-4360.htmlWed, 17 Jun 2026 08:01:44 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escapinhttps://patchthecve.com/cve/CVE-2024-4359.htmlhttps://patchthecve.com/cve/CVE-2024-4359.htmlWed, 17 Jun 2026 08:01:44 +0000MEDIUM 6.5: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. Thttps://patchthecve.com/cve/CVE-2024-4643.htmlhttps://patchthecve.com/cve/CVE-2024-4643.htmlWed, 17 Jun 2026 08:02:19 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘end_redirect_link’ parameter in versions up to, and including, 5.7.1 due to insufficient input sanitization and outpuhttps://patchthecve.com/cve/CVE-2024-39667.htmlhttps://patchthecve.com/cve/CVE-2024-39667.htmlWed, 17 Jun 2026 07:42:25 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.6.11.https://patchthecve.com/cve/CVE-2024-2455.htmlhttps://patchthecve.com/cve/CVE-2024-2455.htmlWed, 17 Jun 2026 07:24:34 +0000MEDIUM 6.4: The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thttps://patchthecve.com/cve/CVE-2024-5555.htmlhttps://patchthecve.com/cve/CVE-2024-5555.htmlWed, 17 Jun 2026 08:16:11 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘social-link-title’ parameter in all versions up to, and including, 5.6.5 due to insufficient input sanitization and ohttps://patchthecve.com/cve/CVE-2024-5554.htmlhttps://patchthecve.com/cve/CVE-2024-5554.htmlWed, 17 Jun 2026 08:16:11 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘onclick_event’ parameter in all versions up to, and including, 5.6.11 due to insufficient input sanitization and outphttps://patchthecve.com/cve/CVE-2024-3925.htmlhttps://patchthecve.com/cve/CVE-2024-3925.htmlWed, 17 Jun 2026 07:45:29 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.11 due to insufficient input sanitization anhttps://patchthecve.com/cve/CVE-2024-5640.htmlhttps://patchthecve.com/cve/CVE-2024-5640.htmlWed, 17 Jun 2026 08:16:20 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ attribute within the Pacific widget in all versions up to, and including, 3.14.7 due to insufficient input sanitization and ohttps://patchthecve.com/cve/CVE-2024-3997.htmlhttps://patchthecve.com/cve/CVE-2024-3997.htmlWed, 17 Jun 2026 07:45:37 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget in all versions up to, and including, 3.14.1 due to insufficient input sanitization and output escapinghttps://patchthecve.com/cve/CVE-2024-3926.htmlhttps://patchthecve.com/cve/CVE-2024-3926.htmlWed, 17 Jun 2026 07:45:29 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization https://patchthecve.com/cve/CVE-2024-3927.htmlhttps://patchthecve.com/cve/CVE-2024-3927.htmlWed, 17 Jun 2026 07:45:29 +0000MEDIUM 5.3: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an https://patchthecve.com/cve/CVE-2024-4339.htmlhttps://patchthecve.com/cve/CVE-2024-4339.htmlWed, 17 Jun 2026 08:01:42 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the General widget in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makeshttps://patchthecve.com/cve/CVE-2024-32682.htmlhttps://patchthecve.com/cve/CVE-2024-32682.htmlWed, 17 Jun 2026 07:30:13 +0000HIGH 7.1: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.https://patchthecve.com/cve/CVE-2024-32681.htmlhttps://patchthecve.com/cve/CVE-2024-32681.htmlWed, 17 Jun 2026 07:30:13 +0000MEDIUM 4.3: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.https://patchthecve.com/cve/CVE-2024-1730.htmlhttps://patchthecve.com/cve/CVE-2024-1730.htmlWed, 17 Jun 2026 07:04:53 +0000MEDIUM 5.4: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via urls in link fields, images from URLs, and html tags used in widgets in https://patchthecve.com/cve/CVE-2024-32572.htmlhttps://patchthecve.com/cve/CVE-2024-32572.htmlWed, 17 Jun 2026 07:29:52 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.6.0.https://patchthecve.com/cve/CVE-2024-1429.htmlhttps://patchthecve.com/cve/CVE-2024-1429.htmlWed, 17 Jun 2026 07:04:13 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab_link’ attribute of the Panel Slider widget in all versions up to, and includhttps://patchthecve.com/cve/CVE-2024-1426.htmlhttps://patchthecve.com/cve/CVE-2024-1426.htmlWed, 17 Jun 2026 07:04:12 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute of the Price List widget in all versions up to, and including, 5https://patchthecve.com/cve/CVE-2024-2966.htmlhttps://patchthecve.com/cve/CVE-2024-2966.htmlWed, 17 Jun 2026 07:25:55 +0000MEDIUM 5.3: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search function. This makes it possible for unauthenhttps://patchthecve.com/cve/CVE-2024-24883.htmlhttps://patchthecve.com/cve/CVE-2024-24883.htmlWed, 17 Jun 2026 07:15:09 +0000MEDIUM 4.3: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.https://patchthecve.com/cve/CVE-2024-1428.htmlhttps://patchthecve.com/cve/CVE-2024-1428.htmlWed, 17 Jun 2026 07:04:13 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘element_pack_wrapper_link’ attribute of the Trailer Box widget in all versions uhttps://patchthecve.com/cve/CVE-2024-0837.htmlhttps://patchthecve.com/cve/CVE-2024-0837.htmlWed, 17 Jun 2026 06:54:24 +0000MEDIUM 6.4: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to, and including, 5.3.2 due to insufficiehttps://patchthecve.com/cve/CVE-2024-30496.htmlhttps://patchthecve.com/cve/CVE-2024-30496.htmlWed, 17 Jun 2026 07:27:04 +0000HIGH 8.5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.https://patchthecve.com/cve/CVE-2024-30186.htmlhttps://patchthecve.com/cve/CVE-2024-30186.htmlWed, 17 Jun 2026 07:26:26 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.1.https://patchthecve.com/cve/CVE-2024-30185.htmlhttps://patchthecve.com/cve/CVE-2024-30185.htmlWed, 17 Jun 2026 07:26:26 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.https://patchthecve.com/cve/CVE-2024-24840.htmlhttps://patchthecve.com/cve/CVE-2024-24840.htmlWed, 17 Jun 2026 07:14:59 +0000MEDIUM 4.3: Missing Authorization vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.4.11.https://patchthecve.com/cve/CVE-2024-1508.htmlhttps://patchthecve.com/cve/CVE-2024-1508.htmlWed, 17 Jun 2026 07:04:23 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings['title_tags']' attribute of the Mercury widget in all versions up to, and including, 3.13.2 due to insufficient input sanitization and output escaping. This makes it possible fhttps://patchthecve.com/cve/CVE-2024-1507.htmlhttps://patchthecve.com/cve/CVE-2024-1507.htmlWed, 17 Jun 2026 07:04:23 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of the Rubix widget in all versions up to, and including, 3.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticathttps://patchthecve.com/cve/CVE-2024-1506.htmlhttps://patchthecve.com/cve/CVE-2024-1506.htmlWed, 17 Jun 2026 07:04:23 +0000MEDIUM 6.4: The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of the Fiestar widget in all versions up to, and including, 3.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authentic