The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce vulnerabilities

Product

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce

by posimyththemes · last CVE Jul 10, 2026

CVEs

On KEV

6.4

Max CVSS

New 30D

Vulnerabilities7 In the news0 Timeline

Severity mix

Critical 0High 0Medium 7Low 0

Severity

All severities7 Critical0 High0 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-15285	6.4	0%	Jul 10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes Affected: through 6.4.11
CVE-2026-9243	6.4	0%	May 29	The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter Affected: through 6.4.15
CVE-2026-5243	6.4	0%	May 14	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget Affected: through 6.4.11
CVE-2026-3311	6.4	0%	Apr 8	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Affected: through 6.4.9
CVE-2025-7646	6.4	0%	Aug 1	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 6.3.10
CVE-2026-2385	5.3	0%	Feb 22	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay Affected: through 6.4.7
CVE-2026-2386	4.3	0%	Feb 18	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' Affected: through 6.4.7