CveMateVulnerability intelligence

Bdthemes vulnerabilities

104 vulnerabilities

Known vulnerabilities in Bdthemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 27 products.

Products

27

Element Pack34 vulnerabilities
Element Pack – Widgets, Templates & Addons For Elementor29 vulnerabilities
Prime Slider – Addons For Elementor19 vulnerabilities
Element Pack Elementor Addons13 vulnerabilities
Prime Slider13 vulnerabilities
Ultimate Store Kit Elementor Addons12 vulnerabilities
Element Pack Pro4 vulnerabilities
Ultimate Store Kit4 vulnerabilities
Zoloblocks4 vulnerabilities
Sigmaforms Pro – AI Generated Forms3 vulnerabilities
Ultimate Store Kit – Addon For Woocommerce, EDD And Elementor3 vulnerabilities
Element Pack Addons For Elementor – Elementor Widgets, Elementor Templates, Elementor Addons2 vulnerabilities
Instant Image Generator2 vulnerabilities
Live Copy Paste For Elementor2 vulnerabilities
Ultimate Post Kit2 vulnerabilities
Ultimate Post Kit Addons For Elementor2 vulnerabilities
Zoloblocks – Gutenberg Block Editor Plugin With Advanced Blocks, Dynamic Content, Templates & Patterns2 vulnerabilities
Element Pack Elementor Addons And Templates1 vulnerabilities
Element Pack Pro Addon For Elementor Page Builder Wordpress Plugin1 vulnerabilities
Live Copy Paste For Elementor – Cross Domain Copy Paste & Page Duplicator1 vulnerabilities
Pixel Gallery Addons For Elementor1 vulnerabilities
Pixel Gallery Addons For Elementor – Easy Grid, Creative Gallery, Drag And Drop Grid, Custom Grid Layout, Portfolio Gallery1 vulnerabilities
Prime Slider – Hero Slider, Carousel, Woocommerce & Post Slider Elementor Addons1 vulnerabilities
Smart Admin Assistant1 vulnerabilities
Spin Wheel – Interactive Spinning Wheel That Offers Coupons1 vulnerabilities
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets1 vulnerabilities
Ultimate Store Kit – Store Builder Addons For Elementor, Woocommerce Store Builder, EDD Store Builder1 vulnerabilities

CVE-2026-109691bdthemesprime slider – addons for elementor7d ago13-10-2026 08:39

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.CVE-2026-108478bdthemeselement pack elementor addons+18d ago12-10-2026 17:11

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.CVE-2025-63079bdthemeslive copy paste for elementor+13mo ago26-06-2026 14:52

Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.CVE-2025-2168bdthemesultimate_store_kit+21y ago01-05-2025 03:23

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-13196bdthemeselement pack – widgets, templates & addons for elementor+111mo ago18-11-2025 09:27

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content parameter in all versions up to, and including, 8.3.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the render function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-1457bdthemeselement pack – widgets, templates & addons for elementor+11y ago19-04-2025 03:21

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-1458bdthemeselement_pack+21y ago26-04-2025 05:34

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-11536bdthemeselement pack – widgets, templates & addons for elementor+11y ago20-10-2025 21:23

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.CVE-2025-68500bdthemesprime slider – addons for elementor+110mo ago24-12-2025 12:31

Server-Side Request Forgery (SSRF) vulnerability in bdthemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Server Side Request Forgery.This issue affects Prime Slider – Addons For Elementor: from n/a through <= 4.0.10.CVE-2025-9075bdthemeszoloblocks – gutenberg block editor plugin with advanced blocks, dynamic content, templates & patterns+11y ago01-10-2025 03:25

The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This is due to insufficient input sanitization and output escaping on user-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-31413bdthemeselement pack elementor addons+19mo ago22-01-2026 16:51

Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This issue affects Element Pack Elementor Addons: from n/a through <= 8.3.13.CVE-2025-14277bdthemesprime slider – addons for elementor+110mo ago18-12-2025 12:22

The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.9 via the import_elementor_template AJAX action. This makes it possible for authenticated attackers, with subscriber level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.CVE-2025-39588bdthemesultimate store kit elementor addons+11y ago17-04-2025 15:46

Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.CVE-2025-7644bdthemespixel gallery addons for elementor – easy grid, creative gallery, drag and drop grid, custom grid layout, portfolio gallery+11y ago22-07-2025 04:25

The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-53210bdthemeszoloblocks+11y ago20-08-2025 08:03

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File Inclusion.This issue affects ZoloBlocks: from n/a through <= 2.3.2.CVE-2025-58230bdthemeszoloblocks+11y ago22-09-2025 18:23

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes ZoloBlocks zoloblocks allows DOM-Based XSS.This issue affects ZoloBlocks: from n/a through <= 2.3.12.CVE-2025-58017bdthemesultimate store kit elementor addons+11y ago22-09-2025 18:24

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.CVE-2025-46257bdthemeselement pack pro+11y ago05-06-2025 17:35

Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.CVE-2025-46258bdthemeselement pack pro+11y ago05-06-2025 17:36

Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0.CVE-2025-5292bdthemeselement pack – widgets, templates & addons for elementor+11y ago31-05-2025 06:40

The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.