PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) vulnerabilities

Product

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)

by ideaboxcreations · last CVE Sep 10, 2025

CVEs

On KEV

6.4

Max CVSS

New 30D

Vulnerabilities10 In the news0 Timeline

Severity mix

Critical 0High 0Medium 10Low 0

Severity

All severities10 Critical0 High0 Medium10 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-8388	6.4	0%	Sep 10	PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url' Affected: through 2.9.4
CVE-2025-1512	6.4	0%	Apr 1	PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.9.0
CVE-2024-5787	5.4	0%	Jun 13	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget Affected: through 2.7.20
CVE-2024-5327	5.4	0%	May 30	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Affected: through 2.7.19
CVE-2024-2492	5.4	0%	Apr 9	PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget Affected: through 2.7.18
CVE-2024-2491	5.4	0%	Mar 30	PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via _html_tag Affected: through 2.7.17
CVE-2024-1411	5.4	0%	Feb 20	PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget Affected: through 2.7.15
CVE-2024-1055	5.4	0%	Feb 7	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.7.14
CVE-2024-10692	4.3	0%	Dec 6	PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure Affected: through 2.8.1
CVE-2023-6984	4.3	0%	Jan 3	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 - Cross-Site Request Forgery Affected: through 2.7.13