Unknown Essential Addons For Elementor vulnerabilities

5 vulnerabilities

Known vulnerabilities in Unknown Essential Addons For Elementor, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4CVE-2021-24255unknownessential addons for elementor+2
EPSS score
0.59%
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.9.8CVE-2022-0320unknownessential addons for elementor+2
EPSS score
1.99%
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.5.3CVE-2026-13345unknownessential addons for elementor+1
EPSS score
0.32%
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.6.4CVE-2026-13344unknownessential addons for elementor+1
EPSS score
0.24%
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.8.1CVE-2026-18039unknownessential addons for elementor+1
EPSS score
0.38%
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.