# Essential Addons for Elementor – Popular Elementor Templates & Widgets

> Elementor addon: 120+ widgets & templates — Elementor Gallery, Mega Menu, Slider, Form, Post Grid, Accordion, Header Footer Builder & WooCommerce.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:38 UTC.

## Facts (WordPress.org)

- Slug: `essential-addons-for-elementor-lite`
- Author: WPDeveloper
- Version: 6.8.8
- Active installs: 1+ million
- Last update: 2026-11-06 (7 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.3, PHP 7.0
- Tags: elementor, elementor addons, elementor templates, elementor widgets, elementor woocommerce
- Page: https://wordpress.org/plugins/essential-addons-for-elementor-lite/

## Checks (against WordPress 7.1.4)

- OK: Updated 7 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Breaking ↔ Smooth, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Slow ↔ Responsive, Locked in ↔ Portable.

## Known vulnerabilities

- 2026-10-31 MEDIUM: Authenticated (Author+) Privilege Escalation (6.6.0 to 6.8.7). CVE-2026-110808, https://www.wordfence.com/threat-intel/vulnerabilities/id/007ec4b0-6ec7-4cd1-ba96-22f880c4282c?source=api-prod
- 2026-10-30 HIGH: Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision (up to 6.8.7). CVE-2026-118205, https://www.wordfence.com/threat-intel/vulnerabilities/id/a739cb9a-0b09-4303-8d4a-16fca1152adf?source=api-prod
- 2026-10-28 MEDIUM: Unauthenticated Information Exposure (before 6.8.7). CVE-2026-110509, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad31a9a-d8be-4a68-bbdb-05e4f2c8ad38?source=api-prod
- 2026-10-28 HIGH: Unauthenticated Registration Approval Bypass (6.7.3 to 6.8.6). CVE-2026-110508, https://www.wordfence.com/threat-intel/vulnerabilities/id/7efbe153-65fe-443f-838f-5fb19af734c6?source=api-prod
- 2026-10-23 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (before 6.8.7). CVE-2026-110510, https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d0811b-0097-4e8e-b585-a83fb807fa74?source=api-prod
- 2026-10-23 LOW: Missing Authorization (before 6.8.7). CVE-2026-110537, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9ec33-75da-4165-819d-16b658b42ea9?source=api-prod
- 2026-10-19 MEDIUM: Authenticated (Author+) Privilege Escalation (up to 6.8.5). CVE-2026-110898, https://www.wordfence.com/threat-intel/vulnerabilities/id/088ea35b-ef64-4c1b-8a08-5dce02ca3da9?source=api-prod
- 2026-10-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.8.4). CVE-2026-102394, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4c1e51-b332-4feb-8875-d43c9541342f?source=api-prod
- 2026-08-28 MEDIUM: Unauthenticated Captcha Bypass (up to 6.8.0). CVE-2026-81777, https://www.wordfence.com/threat-intel/vulnerabilities/id/a151c680-2bcf-4b36-aa6e-9694c6d3d0c7?source=api-prod
- 2026-08-14 HIGH: Unauthenticated Privilege Escalation (up to 6.7.1). CVE-2026-18039, https://www.wordfence.com/threat-intel/vulnerabilities/id/69caeed4-f9e4-426a-9acb-1f52a6251072?source=api-prod
- 2026-07-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (before 6.6.10). CVE-2026-13344, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ddb9c46-683d-4eb4-a30f-f492d4f3ae2d?source=api-prod
- 2026-07-30 MEDIUM: Missing Authorization (before 6.6.10). CVE-2026-13345, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f38e5f0-6c62-4c0a-99f9-09bc20ee87d4?source=api-prod
- 2026-07-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings (up to 6.6.11). CVE-2026-15156, https://www.wordfence.com/threat-intel/vulnerabilities/id/dde0cf3a-778b-4b5f-ac0e-600505d918ae?source=api-prod
- 2026-07-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget (up to 6.6.11). CVE-2026-15145, https://www.wordfence.com/threat-intel/vulnerabilities/id/2100d720-bfb4-451d-9907-e0b77ef507a5?source=api-prod
- 2026-07-11 HIGH: Authenticated (Contributor+) Account Takeover via Email Header Injection (up to 6.6.10). CVE-2026-15155, https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe8cf6c-b1fa-4f71-bb63-c8b181e54882?source=api-prod
- 2026-07-08 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup (up to 6.6.2). CVE-2026-6459, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3214a5-7044-4005-a200-c969d4487be2?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (before 6.6.0). CVE-2026-25440, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2552407-0b32-4129-b131-792305ed023e?source=api-prod
- 2026-06-06 MEDIUM: Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler (up to 6.6.4). CVE-2026-7665, https://www.wordfence.com/threat-intel/vulnerabilities/id/861ece65-bee7-4124-b1a8-de9fb0c1cbc7?source=api-prod
- 2026-05-14 MEDIUM: Authenticated (Author+) Limited Privilege Escalation via register_user (up to 6.5.13). CVE-2026-5193, https://www.wordfence.com/threat-intel/vulnerabilities/id/22930940-8e2c-446a-954c-90d617f3ca6d?source=api-prod
- 2026-02-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget (up to 6.5.9). CVE-2026-1512, https://www.wordfence.com/threat-intel/vulnerabilities/id/d652f383-ca3d-440e-a30f-64a50efd65e1?source=api-prod
- 2026-01-15 MEDIUM: Missing Authorization to Unauthenticated Sensitive Information Exposure (up to 6.5.5). CVE-2026-1004, https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=api-prod
- 2026-01-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.5.3). CVE-2025-69092, https://www.wordfence.com/threat-intel/vulnerabilities/id/56ba7d1b-7afd-4069-8b18-1158911fce3f?source=api-prod
- 2025-12-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.5.3). CVE-2025-13977, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0de0b28-fbad-4fcf-a7ab-35c545c19a4a?source=api-prod
- 2025-11-18 MEDIUM: Missing Authorization (up to 6.5.5). CVE-2026-23543, https://www.wordfence.com/threat-intel/vulnerabilities/id/063b50e3-1369-4240-b695-6ac336f4ea75?source=api-prod
- 2025-09-17 MEDIUM: Missing Authorization (up to 6.2.4). CVE-2025-64352, https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb2c608-1a1f-4c74-aa24-b955db052559?source=api-prod
- 2025-08-14 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items' (up to 6.2.2). CVE-2025-8451, https://www.wordfence.com/threat-intel/vulnerabilities/id/4917652a-1c83-4570-98c5-1a34e637814e?source=api-prod
- 2025-07-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets (up to 6.1.19). CVE-2025-6244, https://www.wordfence.com/threat-intel/vulnerabilities/id/847a4fc7-3580-421e-8045-41b5a85f2d97?source=api-prod
- 2025-07-02 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (up to 6.0.4). WF-dae80fc2-3076-4a32-876d-5df1c62de9bd-14, https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=api-prod
- 2025-06-06 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (up to 6.1.12). CVE-2024-9994, https://www.wordfence.com/threat-intel/vulnerabilities/id/855ae993-d887-4416-9b3c-8274a90dce5f?source=api-prod
- 2025-06-06 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget (up to 6.1.12). CVE-2024-9993, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8de8a0b-0b70-4e8a-8cc4-06cc50d06a02?source=api-prod
- 2025-04-16 MEDIUM: Authenticated (Contributor+) Information Disclosure (up to 6.1.9). CVE-2025-39589, https://www.wordfence.com/threat-intel/vulnerabilities/id/434b140a-43b7-41bc-8cc2-ed82787b90c3?source=api-prod
- 2025-04-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.1.9). CVE-2025-39590, https://www.wordfence.com/threat-intel/vulnerabilities/id/71378c94-c2e6-43a9-bb8b-f2ffb153f3fe?source=api-prod
- 2025-02-04 MEDIUM: Reflected Cross-Site Scripting (up to 6.0.14). CVE-2025-24752, https://www.wordfence.com/threat-intel/vulnerabilities/id/710e1c2c-4b5d-412c-950d-b5e530abf3a7?source=api-prod
- 2024-12-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.0.7). CVE-2024-56063, https://www.wordfence.com/threat-intel/vulnerabilities/id/167d3e1d-be74-4bfb-b3bf-e2c53d90e12f?source=api-prod
- 2024-11-14 HIGH: Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation (up to 6.0.9). CVE-2024-8979, https://www.wordfence.com/threat-intel/vulnerabilities/id/34d09086-be33-40cf-b5bf-d6c03cf0b68a?source=api-prod
- 2024-11-14 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.0.7). CVE-2024-8961, https://www.wordfence.com/threat-intel/vulnerabilities/id/45ef20aa-18e3-4ad8-a94e-76e29de5b562?source=api-prod
- 2024-11-14 MEDIUM: Authenticated (Contributor+) Sensitive Information Exposure (up to 6.0.9). CVE-2024-8978, https://www.wordfence.com/threat-intel/vulnerabilities/id/baae8fb9-b87c-4f61-88da-871c4c83615b?source=api-prod
- 2024-09-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget (up to 6.0.3). CVE-2024-8742, https://www.wordfence.com/threat-intel/vulnerabilities/id/76c292dc-e9da-4256-82df-58ac5def4771?source=api-prod
- 2024-09-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget (up to 6.0.3). CVE-2024-8440, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5960396-5320-4978-aa82-2e33700daa43?source=api-prod
- 2024-08-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter (up to 5.9.27). CVE-2024-7092, https://www.wordfence.com/threat-intel/vulnerabilities/id/718c60c1-6117-4959-a907-d0ef457f7185?source=api-prod
- 2024-08-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.26). CVE-2024-39649, https://www.wordfence.com/threat-intel/vulnerabilities/id/eee7cad6-7910-4860-add9-c500d1f6eff3?source=api-prod
- 2024-06-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.23). CVE-2024-5189, https://www.wordfence.com/threat-intel/vulnerabilities/id/aa70238b-530e-4c90-82f4-c3113887d0e1?source=api-prod
- 2024-06-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.22). CVE-2024-5188, https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1d5fd1-80b6-4d62-9837-59ee1e020373?source=api-prod
- 2024-05-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed (up to 5.9.21). CVE-2024-5073, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8db80ef-5863-41dd-b33f-850984a72ee6?source=api-prod
- 2024-05-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.15). CVE-2024-34764, https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb6961b-1398-409d-ada2-cf5424cb2b73?source=api-prod
- 2024-05-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.20). CVE-2024-4624, https://www.wordfence.com/threat-intel/vulnerabilities/id/bedad627-0ccb-41c1-be8d-753f57be618f?source=api-prod
- 2024-05-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' (up to 5.9.19). CVE-2024-4448, https://www.wordfence.com/threat-intel/vulnerabilities/id/21e12c72-7898-4896-9852-ebb10e5f9a3b?source=api-prod
- 2024-05-09 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets (up to 5.9.19). CVE-2024-4449, https://www.wordfence.com/threat-intel/vulnerabilities/id/57ed6c7e-ca8d-476d-adce-905b2cd2eda8?source=api-prod
- 2024-05-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' (up to 5.9.19). CVE-2024-4275, https://www.wordfence.com/threat-intel/vulnerabilities/id/91f50b65-f001-4c73-bfe3-1aed3fc10d26?source=api-prod
- 2024-04-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.17). CVE-2024-4156, https://www.wordfence.com/threat-intel/vulnerabilities/id/23a66e6b-cec0-4110-9bef-a5d41ce1c954?source=api-prod
- 2024-04-24 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.15). CVE-2024-4003, https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf3190c-e247-4bcc-99e0-2ab2d2fa0590?source=api-prod
- 2024-04-24 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle (up to 5.9.15). CVE-2024-3728, https://www.wordfence.com/threat-intel/vulnerabilities/id/284ea577-ff67-4681-995b-f7bb5ef0ff3e?source=api-prod
- 2024-04-24 MEDIUM: Information Exposure (up to 5.9.15). CVE-2024-3733, https://www.wordfence.com/threat-intel/vulnerabilities/id/3d604f7a-947c-43f4-bba6-e7e98b2d7844?source=api-prod
- 2024-04-16 MEDIUM: Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute (up to 5.9.14). CVE-2024-3333, https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5bdaf9-fbde-40d4-a72a-fd24489818b3?source=api-prod
- 2024-03-29 HIGH: Authenticated (Author+) PHP Object Injection via error_resetpassword (up to 5.9.13). CVE-2024-3018, https://www.wordfence.com/threat-intel/vulnerabilities/id/342049e5-834e-4867-8174-01ca7bb0caa2?source=api-prod
- 2024-03-29 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 5.9.13). CVE-2024-2974, https://www.wordfence.com/threat-intel/vulnerabilities/id/78f96d7f-aeca-4959-9573-0fb6402de007?source=api-prod
- 2024-03-25 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.11). CVE-2024-2650, https://www.wordfence.com/threat-intel/vulnerabilities/id/7242d808-9c33-4b3f-bda6-b4b72ca37de9?source=api-prod
- 2024-03-25 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.11). CVE-2024-2623, https://www.wordfence.com/threat-intel/vulnerabilities/id/baa92aee-a0a0-45d4-aa12-1449a829930c?source=api-prod
- 2024-03-11 HIGH: Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar (up to 5.9.9). CVE-2024-1536, https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc9e63-17bb-4755-be3c-ae8b26edd3cd?source=api-prod
- 2024-03-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table (up to 5.9.9). CVE-2024-1537, https://www.wordfence.com/threat-intel/vulnerabilities/id/81a48c61-4191-4252-9230-9df8fc5e3443?source=api-prod
- 2024-02-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.8). CVE-2024-1236, https://www.wordfence.com/threat-intel/vulnerabilities/id/43014ecd-72d9-44cc-be24-c0c9790ddc20?source=api-prod
- 2024-02-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.8). CVE-2024-1276, https://www.wordfence.com/threat-intel/vulnerabilities/id/af8bee01-15bc-485e-8b01-8b68b199b34d?source=api-prod
- 2024-02-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion (up to 5.9.8). CVE-2024-1172, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ff2cc6-b584-442b-890b-033a0a047c24?source=api-prod
- 2024-02-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery (up to 5.9.8). CVE-2024-1171, https://www.wordfence.com/threat-intel/vulnerabilities/id/fafdd087-9637-41df-bc5a-97e1a02ea744?source=api-prod
- 2024-02-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.7). CVE-2024-0954, https://www.wordfence.com/threat-intel/vulnerabilities/id/875db71d-c799-40b9-95e1-74d53046b0a9?source=api-prod
- 2024-01-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl (up to 5.9.4). CVE-2024-0585, https://www.wordfence.com/threat-intel/vulnerabilities/id/417baa1c-29f0-4fec-8008-5b52359b3328?source=api-prod
- 2024-01-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scritping (up to 5.9.4). CVE-2024-0586, https://www.wordfence.com/threat-intel/vulnerabilities/id/c00ff4bd-d846-4e3f-95ed-2a6430c47ebf?source=api-prod
- 2024-01-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.2). CVE-2023-7044, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e770e98-3c13-4e37-b51b-4c39bce2cb42?source=api-prod
- 2023-09-14 HIGH: Authenticated (Contributor+) Privilege Escalation (up to 5.8.8). CVE-2023-41955, https://www.wordfence.com/threat-intel/vulnerabilities/id/8c13701e-424d-462f-b152-4dc5ad3ef197?source=api-prod
- 2023-07-19 MEDIUM: Unauthenticated MailChimp API Key Disclosure (up to 5.8.1). CVE-2023-3779, https://www.wordfence.com/threat-intel/vulnerabilities/id/e007c713-74bc-4ff5-a198-70dcc8a8ee68?source=api-prod
- 2023-05-11 CRITICAL: Unauthenticated Arbitrary Password Reset to Privilege Escalation (up to 5.7.1). CVE-2023-32243, https://www.wordfence.com/threat-intel/vulnerabilities/id/e988d042-147c-4782-b728-71f5a50cecd8?source=api-prod
- 2022-02-18 MEDIUM: Reflected Cross-Site Scripting (up to 5.0.8). CVE-2022-0683, https://www.wordfence.com/threat-intel/vulnerabilities/id/8869a4fc-279f-4828-a271-8680d037fa85?source=api-prod
- 2022-01-21 CRITICAL: Local File Inclusion (1.0.0 to 5.0.4). CVE-2022-0320, https://www.wordfence.com/threat-intel/vulnerabilities/id/014f1aae-10a0-4bc8-b176-dbdad94a6ad8?source=api-prod
- 2021-05-05 MEDIUM: Missing Authorization (up to 4.6.4). CVE-2021-4446, https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=api-prod
- 2021-05-05 HIGH: Authenticated (Contributor+) Privilege Escalation (up to 4.6.4). CVE-2021-4447, https://www.wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a?source=api-prod
- 2021-04-13 MEDIUM: Cross-Site Scripting (before 4.5.4). CVE-2021-24255, https://www.wordfence.com/threat-intel/vulnerabilities/id/de614bbd-42ae-4c2a-aec6-31245124de76?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=essential-addons-for-elementor-lite · HTML: https://todaywp.com/plugins/essential-addons-for-elementor-lite