The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce vulnerabilities

Product

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce

by posimyththemes · last CVE Jul 10, 2026

CVEs

On KEV

6.4

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 0High 0Medium 14Low 0

Severity

All severities14 Critical0 High0 Medium14 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-15285	6.4	0%	Jul 10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes Affected: through 6.4.11
CVE-2026-9243	6.4	0%	May 29	The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter Affected: through 6.4.15
CVE-2026-5243	6.4	0%	May 14	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget Affected: through 6.4.11
CVE-2026-3311	6.4	0%	Apr 8	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Affected: through 6.4.9
CVE-2025-7646	6.4	0%	Aug 1	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 6.3.10
CVE-2025-1287	5.4	0%	Mar 8	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Affected: through 6.2.2
CVE-2024-11829	5.4	0%	Feb 1	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 6.1.8
CVE-2024-5583	5.4	0%	Aug 22	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings Affected: through 5.6.2
CVE-2024-6575	5.4	0%	Aug 20	The Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget Affected: through 5.6.2
CVE-2024-5763	5.4	0%	Aug 20	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget Affected: through 5.6.2
CVE-2026-2385	5.3	0%	Feb 22	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay Affected: through 6.4.7
CVE-2026-2386	4.3	0%	Feb 18	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' Affected: through 6.4.7
CVE-2024-10365	4.3	0%	Nov 20	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates Affected: through 6.0.3
CVE-2024-8913	4.3	0%	Oct 11	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template Affected: through 5.6.11