roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor version is affected

Latest roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor vulnerabilities

CVE-2026-94500 — WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2026-4362 — ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite (CVSS 6.5)
CVE-2026-2600 — ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget (CVSS 6.4)
CVE-2026-23693 — ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint (CVSS 10.0)
CVE-2024-37255 — WordPress ElementsKit Lite plugin <= 3.1.4 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3)
CVE-2024-10091 — ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget (CVSS 5.4)
CVE-2024-6455 — ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function (CVSS 5.3)
CVE-2023-39993 — WordPress ElementsKit Lite plugin <= 2.9.0 - Broken Access Control vulnerability (CVSS 4.3)
CVE-2024-3650 — (CVSS 5.4)
CVE-2024-3499 — ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module (CVSS 8.8)
CVE-2024-32505 — WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-2803 — ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 5.4)
CVE-2024-2047 — ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw (CVSS 8.8)
CVE-2024-1238 — ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-2042 — ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget (CVSS 5.4)
CVE-2024-1239 — ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2023-6582 — ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
CVE-2021-24258 — ElementsKit and ElementsKit Pro < 2.2.0 - Contributor+ Stored XSS (CVSS 5.4)