What’s Vulnerable › Products

bdthemes Element Pack – Widgets, Templates & Addons for Elementor vulnerabilities

50 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your bdthemes Element Pack – Widgets, Templates & Addons for Elementor version is affected

Latest bdthemes Element Pack – Widgets, Templates & Addons for Elementor vulnerabilities

• CVE-2026-108478 — WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-105873 — WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-105871 — WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-66574 — WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-65502 — WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability (CVSS 5.3)
• CVE-2026-40721 — WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability (CVSS 7.5)
• CVE-2026-40745 — WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability (CVSS 7.6)
• CVE-2026-4655 — Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget (CVSS 6.4)
• CVE-2026-1793 — Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5)
• CVE-2025-31413 — WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
• CVE-2025-13196 — Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget (CVSS 5.4)
• CVE-2025-11536 — Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery (CVSS 5.0)
• CVE-2025-8100 — Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content (CVSS 5.4)
• CVE-2025-5944 — Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute (CVSS 5.4)
• CVE-2025-46258 — WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2025-46257 — WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
• CVE-2025-5292 — Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2025-1458 — Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2025-1457 — Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2024-12851 — Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-11852 — Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization (CVSS 4.3)
• CVE-2024-9058 — Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget (CVSS 5.4)
• CVE-2024-10980 — Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2024-10493 — Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2024-9867 — Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget (CVSS 5.4)