WordPress Vulnerability Scanner WPSec
Vulnerabilities / The Plus Addons for Elementor

The Plus Addons for Elementor vulnerabilities

Advisories WPSec published for The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates. Other sources may list more. Its attack surface: The Plus Addons for Elementor on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-02 WPSEC-2026-0271 The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hover Card Widget Script Content Medium 5.4 6.5.2
2026-10-02 WPSEC-2026-0270 The Plus Addons for Elementor <= 6.5.1 - Unauthenticated Information Exposure of Unapproved Comments via Post Comment Widget Medium 5.3 6.5.2
2026-10-02 WPSEC-2026-0269 The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Listing Widget 'All Posts Loaded Text' Setting Medium 5.4 6.5.2
2026-10-02 WPSEC-2026-0268 The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Missing Authorization in MCP Abilities to Sensitive Information Exposure and Template Publishing Medium 5.4 6.5.2
2026-10-02 WPSEC-2026-0267 The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion via Blog Widget 'post_category_style' Setting High 8.8 6.5.2
2026-10-02 WPSEC-2026-0266 The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box and Flip Box Widget Button Text Medium 6.4 6.5.2

License: CC BY 4.0