Plugin icon

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons

bdthemes-element-pack-lite

Vulnerabilities:

43

Last Updated:

September 16, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-08-08
Title
BdThemes Multiple Plugins - XSS via 'display_id' from Sigmative API
Fixed in
Fixed in 8.7.15
CVSS
5.4 (medium)
Published
2026-08-06
Title
Element Pack Addons for Elementor < 8.3.16 - Unauthenticated Email Header Injection via element_pack_contact_form
Fixed in
Fixed in 8.3.16
CVSS
5.3 (medium)
Published
2026-07-28
Title
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons < 8.7.14 - Missing Authorization
Fixed in
Fixed in 8.7.14
CVSS
5.3 (medium)
Published
2026-07-21
Title
Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
Fixed in
Fixed in 8.7.13
CVSS
6.8 (medium)
Published
2026-04-07
Title
Element Pack Addons for Elementor < 8.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Fixed in
Fixed in 8.5.0
CVSS
5.5 (medium)
Published
2026-03-23
Title
Element Pack Elementor Addons < 8.5.0 - Authenticated (Editor+) SQL Injection
Fixed in
Fixed in 8.5.0
CVSS
4.9 (medium)
Published
2026-02-14
Title
Element Pack Addons for Elementor < 8.3.18 - Authenticated (Contributor+) Arbitrary File Read
Fixed in
Fixed in 8.3.18
CVSS
6.5 (medium)
Published
2026-01-16
Title
Element Pack Elementor Addons < 8.3.14 - Cross-Site Request Forgery
Fixed in
Fixed in 8.3.14
CVSS
4.3 (medium)
Published
2025-11-17
Title
Element Pack Addons for Elementor < 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget
Fixed in
Fixed in 8.3.5
CVSS
5.4 (medium)
Published
2025-10-20
Title
Element Pack Addons for Elementor < 8.2.6 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
Fixed in
Fixed in 8.2.6
CVSS
5 (medium)
Published
2025-08-05
Title
Element Pack Elementor Addons and Templates < 8.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
Fixed in
Fixed in 8.1.6
CVSS
5.4 (medium)
Published
2025-07-02
Title
Element Pack Addons for Elementor < 8.1.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
Fixed in
Fixed in 8.1.0
CVSS
6.4 (medium)
Published
2025-05-30
Title
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder < 5.11.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 5.11.3
CVSS
6.4 (medium)
Published
2025-04-25
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) < 5.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.10.30
CVSS
6.4 (medium)
Published
2025-04-18
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) < 5.10.29 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 5.10.29
CVSS
6.4 (medium)
Published
2025-01-07
Title
Element Pack Lite - Addons for Elementor < 5.10.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.10.15
CVSS
6.4 (medium)
Published
2024-12-21
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.10.13 - Missing Authorization
Fixed in
Fixed in 5.10.13
CVSS
4.3 (medium)
Published
2024-12-02
Title
Element Pack Elementor Addons < 5.10.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget
Fixed in
Fixed in 5.10.6
CVSS
6.4 (medium)
Published
2024-11-08
Title
Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS
Fixed in
Fixed in 5.10.3
CVSS
5.9 (medium)
Published
2024-11-07
Title
Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS
Fixed in
Fixed in 5.10.3
CVSS
5.9 (medium)
Published
2024-11-04
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.10.3 - Authenticated (Contributor+ Stored Cross-Site Scripting via Open Map Widget
Fixed in
Fixed in 5.10.3
CVSS
5.4 (medium)
Published
2024-11-04
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.10.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 5.10.3
CVSS
6.5 (medium)
Published
2024-11-01
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
Fixed in
Fixed in 5.10.2
CVSS
5.4 (medium)
Published
2024-11-01
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget
Fixed in
Fixed in 5.10.2
CVSS
6.4 (medium)
Published
2024-09-30
Title
Element Pack Elementor Addons < 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.7.6
CVSS
6.4 (medium)
Published
2024-08-12
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets
Fixed in
Fixed in 5.7.3
CVSS
6.4 (medium)
Published
2024-08-08
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
Fixed in
Fixed in 5.7.3
CVSS
6.5 (medium)
Published
2024-08-08
Title
Element Pack Elementor Addons < 5.7.7 - Contributor+ Stored XSS via title_tag
Fixed in
Fixed in 5.7.7
CVSS
5.9 (medium)
Published
2024-08-01
Title
Element Pack Elementor Addons < 5.6.12 - Contributor+ Stored XSS
Fixed in
Fixed in 5.6.12
CVSS
5.9 (medium)
Published
2024-07-17
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.6.6
CVSS
6.4 (medium)
Published
2024-07-17
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.6.12
CVSS
6.4 (medium)
Published
2024-06-11
Title
Element Pack Elementor Addons < 5.6.12 - Contributor+ Stored XSS via onclick events
Fixed in
Fixed in 5.6.12
CVSS
5.9 (medium)
Published
2024-05-21
Title
Element Pack Elementor Addons < 5.6.2 - Contributor+ Stored XSS
Fixed in
Fixed in 5.6.2
CVSS
5.9 (medium)
Published
2024-05-21
Title
Element Pack Elementor Addons < 5.6.4 - Form Submission Admin Email Bypass
Fixed in
Fixed in 5.6.4
CVSS
5.3 (medium)
Published
2024-04-17
Title
Element Pack Elementor Addons < 5.6.1 - Contributor+ Stored XSS via Price List Widget
Fixed in
Fixed in 5.6.1
CVSS
5.9 (medium)
Published
2024-04-17
Title
Element Pack Elementor Addons < 5.6.1 - Contributor+ Stored XSS via Panel Slider Widget
Fixed in
Fixed in 5.6.1
CVSS
5.9 (medium)
Published
2024-04-10
Title
Element Pack Elementor Addons < 5.6.0 - Sensitive Information Exposure via element_pack_ajax_search
Fixed in
Fixed in 5.6.0
CVSS
5.3 (medium)
Published
2024-04-05
Title
Element Pack Elementor Addons < 5.5.4 - Contributor+ Stored XSS via Trailer Box Widget
Fixed in
Fixed in 5.5.4
CVSS
5.9 (medium)
Published
2024-04-05
Title
Element Pack Elementor Addons < 5.3.3 - Contributor+ Stored XSS via Custom Gallery Widget
Fixed in
Fixed in 5.3.3
CVSS
5.9 (medium)
Published
2024-03-28
Title
Element Pack Elementor Addons < 5.5.4 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 5.5.4
CVSS
6.8 (medium)
Published
2024-03-25
Title
Element Pack Elementor Addons < 5.5.4 - Contributor+ Stored XSS
Fixed in
Fixed in 5.5.4
CVSS
5.9 (medium)
Published
2024-02-02
Title
Element Pack Elementor Addons < 5.4.12 - Missing Authorization via bdt_duplicate_as_draft
Fixed in
Fixed in 5.4.12
CVSS
4.3 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.2.1
CVSS
6.1 (medium)