What’s Vulnerable › Vulnerabilities

CVE-2024-13215: Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-15 · updated 2026-06-17
• Weakness: CWE-359

Description

The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.

Affected products

• wpvibes Addon Elements for Elementor (formerly Elementor Addon Elements): before 1.14 — fixed in 1.14

How to fix

Upgrade to a fixed version: wpvibes Addon Elements for Elementor (formerly Elementor Addon Elements) 1.14. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/modal-popup/widgets/modal-popup.php#L1058
• https://plugins.trac.wordpress.org/changeset/3221982/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4feacb75-0533-4f53-8ce9-3e45ee8336e2?source=cve

Get alerted when CVE-2024-13215 or the next vulnerability affects your stack