Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: roxnor Component: Elementskit Elementor Addons Clear all filters
TI-2025-03181 CVE-2025-3614 · GHSA-qc8c-76wh-84xm

Cross-site scripting in roxnor ElementsKit Elementor Addons – Advanced Widgets &…

Priority LOW 28

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00302 Published 2025-07-24 No fix listed CWE-79
TI-2025-03995 CVE-2025-4479 · GHSA-g7m8-89p7-gcjp

ElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget

Priority LOW 28

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 du…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00254 Published 2025-06-19 No fix listed CWE-79
TI-2024-10355 CVE-2024-11180 · GHSA-xp66-frv9-rr2c

ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title parameter in all versions up to, and including, 3.4.7 due to in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00274 Published 2025-03-29 No fix listed CWE-79
TI-2025-00819 CVE-2025-0968 · GHSA-8528-jjpw-q9wx

ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function

Priority LOW 31

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a missing capability checks on the get_megamenu_content() function.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00489 Published 2025-02-19 No fix listed CWE-284
TI-2025-00847 CVE-2025-1005 · GHSA-g34f-m46c-hwf3

Cross-site scripting in roxnor ElementsKit Elementor Addons – Advanced Widgets &…

Priority LOW 30

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up to, and including, 3.4.0 due to insufficient input sanitizatio…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0036 Published 2025-02-15 No fix listed CWE-79
TI-2024-07922 CVE-2024-8546 · GHSA-73q2-8gvp-gh6w

ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget

Priority LOW 29

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video widget in all versions up to, and including, 3.2.7 due to insufficient input sanitization and outp…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00443 Published 2024-09-25 No fix listed CWE-79
TI-2023-05980 CVE-2023-6525 · GHSA-45hm-gg77-pjg9

ElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting

Priority LOW 25

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up to, and including, 3.0.3 due to insufficient input sanitizatio…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00428 Published 2024-03-16 No fix listed CWE-79