# Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates

> 90+ Elementor widgets & addons, 600+ templates, Mega Menu, WooCommerce, Display Conditions. The only Elementor addon AI agents can fully build with.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:39 UTC.

## Facts (WordPress.org)

- Slug: `premium-addons-for-elementor`
- Author: Leap13
- Version: 4.11.119
- Active installs: 600,000+
- Last update: 2026-11-12 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.6, PHP 7.4
- Tags: AI, elementor addons, elementor templates, elementor widgets, mcp
- Page: https://wordpress.org/plugins/premium-addons-for-elementor/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Slows pages ↔ Speeds up, Slow ↔ Responsive, Locked in ↔ Portable, Paywalled ↔ Generous, Cluttered ↔ Clean.

## Known vulnerabilities

- 2026-11-11 MEDIUM: Cross-site Scripting (up to 4.11.116). CVE-2026-125762, https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-116-cross-site-scripting-xss-vulnerability?_s_id=cve
- 2026-10-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.11.110). CVE-2026-108490, https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9e0d69-8be6-442c-aa26-a6e9df6b533b?source=api-prod
- 2026-10-13 MEDIUM: Missing Authorization (up to 4.11.110). CVE-2026-109890, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8812c90-b485-45dc-bae7-086dd9473903?source=api-prod
- 2026-10-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.11.110). CVE-2026-108482, https://www.wordfence.com/threat-intel/vulnerabilities/id/70e6fce5-dae3-447f-8342-542e8f61168d?source=api-prod
- 2026-10-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.11.109). CVE-2026-103084, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7d527b-00cc-46b7-afc0-732362ba7953?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.11.105). CVE-2026-62078, https://www.wordfence.com/threat-intel/vulnerabilities/id/7121bccd-9a93-4547-8882-4000b1fc1e50?source=api-prod
- 2026-09-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.11.105). CVE-2026-94168, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bff5293-fcb3-4968-972b-8f38052a877b?source=api-prod
- 2026-07-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter (up to 4.11.84). CVE-2026-12141, https://www.wordfence.com/threat-intel/vulnerabilities/id/867a0742-4fa9-4473-8d51-9abb6ec353a8?source=api-prod
- 2026-05-02 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter (up to 4.11.70). CVE-2026-4790, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae6d07eb-3e64-45ee-ad5d-92b41ef11e43?source=api-prod
- 2026-01-17 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Settings Update (up to 4.11.63). CVE-2025-69300, https://www.wordfence.com/threat-intel/vulnerabilities/id/59edf88d-a16d-48ec-981a-0002730f4091?source=api-prod
- 2025-12-22 MEDIUM: Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content' (up to 4.11.53). CVE-2025-14155, https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=api-prod
- 2025-12-22 MEDIUM: Cross-Site Request Forgery via 'insert_inner_template' (up to 4.11.53). CVE-2025-14163, https://www.wordfence.com/threat-intel/vulnerabilities/id/77b57f2a-0b46-4b4a-bdca-1c5218d739ce?source=api-prod
- 2025-12-04 MEDIUM: Unauthenticated Information Exposure (up to 4.11.53). CVE-2025-68494, https://www.wordfence.com/threat-intel/vulnerabilities/id/8e13e57e-becf-4f03-bba2-e4584c84b95c?source=api-prod
- 2025-07-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.69). CVE-2024-11937, https://www.wordfence.com/threat-intel/vulnerabilities/id/26337385-646f-4129-99be-7fa020f67f8e?source=api-prod
- 2025-06-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (up to 4.11.8). CVE-2025-4774, https://www.wordfence.com/threat-intel/vulnerabilities/id/024af9de-d4c7-43ec-a602-c45ded3ddad3?source=api-prod
- 2024-12-19 MEDIUM: Missing Authorization (up to 4.10.56). CVE-2024-56225, https://www.wordfence.com/threat-intel/vulnerabilities/id/575a648a-6bf0-42d9-964e-59800e856bd0?source=api-prod
- 2024-10-28 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget (up to 4.10.60). CVE-2024-10266, https://www.wordfence.com/threat-intel/vulnerabilities/id/c6102c07-2776-4963-8d16-a779c5979275?source=api-prod
- 2024-09-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget (up to 4.10.52). CVE-2024-8681, https://www.wordfence.com/threat-intel/vulnerabilities/id/de207181-0163-4222-ac16-d7b74179ff9b?source=api-prod
- 2024-08-07 MEDIUM: Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update (up to 4.10.38). CVE-2024-6824, https://www.wordfence.com/threat-intel/vulnerabilities/id/b2840b9e-1baf-460c-ba11-43e4279ece27?source=api-prod
- 2024-07-11 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget (up to 4.10.36). CVE-2024-6495, https://www.wordfence.com/threat-intel/vulnerabilities/id/005fc05c-6d82-49ca-b114-a3e64a3a572f?source=api-prod
- 2024-07-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.34). CVE-2024-37922, https://www.wordfence.com/threat-intel/vulnerabilities/id/a155c289-558c-4209-8d9a-bf085fecaf8a?source=api-prod
- 2024-07-03 LOW: Regular Expressions Denial of Service (up to 4.10.35). CVE-2024-6434, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c59d95a-b7f1-4a04-bbf4-bab2c42d6d75?source=api-prod
- 2024-07-02 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (up to 4.10.36). CVE-2024-6340, https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed80507-f3e5-45a8-9498-8cebf97155ff?source=api-prod
- 2024-06-11 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (up to 4.10.33). CVE-2024-5553, https://www.wordfence.com/threat-intel/vulnerabilities/id/a80a3108-c685-4e26-9ecd-a0fe6ad4860c?source=api-prod
- 2024-05-30 MEDIUM: Missing Authorization to Information Disclosure (up to 4.10.31). CVE-2024-4205, https://www.wordfence.com/threat-intel/vulnerabilities/id/175cb977-dcba-429f-814c-6de078e23472?source=api-prod
- 2024-05-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget (up to 4.10.31). CVE-2024-4376, https://www.wordfence.com/threat-intel/vulnerabilities/id/b49d166f-4df0-4997-a078-0be8fcd92576?source=api-prod
- 2024-05-30 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip (up to 4.10.31). CVE-2024-4379, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0261c6-0477-4769-b92a-b49a192df4bb?source=api-prod
- 2024-05-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider (up to 4.10.31). CVE-2024-4378, https://www.wordfence.com/threat-intel/vulnerabilities/id/f891a6c8-3d06-432e-8651-bb689015af1c?source=api-prod
- 2024-04-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.30). CVE-2024-4203, https://www.wordfence.com/threat-intel/vulnerabilities/id/51fab95e-336d-4544-8b8e-c4e9002321ec?source=api-prod
- 2024-04-24 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style' (up to 4.10.28). CVE-2024-3647, https://www.wordfence.com/threat-intel/vulnerabilities/id/48fdece5-2996-426f-b77c-ae0b35bcd0ce?source=api-prod
- 2024-04-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.28). CVE-2024-3885, https://www.wordfence.com/threat-intel/vulnerabilities/id/4111ba11-ad79-466a-9669-3c35730a331a?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.25). CVE-2024-32791, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce0e587-0312-4484-8f03-c82db67aba44?source=api-prod
- 2024-04-09 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget (up to 4.10.16). CVE-2024-0376, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9eb9cb-ead9-4ddf-b40b-a0ce2f4910f6?source=api-prod
- 2024-04-09 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (up to 4.10.24). CVE-2024-2666, https://www.wordfence.com/threat-intel/vulnerabilities/id/18b2d99a-f55c-4a05-8442-e1fddd59181f?source=api-prod
- 2024-04-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Button (up to 4.10.27). CVE-2024-2665, https://www.wordfence.com/threat-intel/vulnerabilities/id/cab56873-f79c-4fd2-8d40-ee4a338cbe8b?source=api-prod
- 2024-04-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.24). CVE-2024-2664, https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb7e94c-385e-4ce9-acfa-978403047159?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Contributor+) Sensitive Information Exposure (up to 4.10.22). CVE-2024-31278, https://www.wordfence.com/threat-intel/vulnerabilities/id/a78fced7-8c8c-4e98-8f06-2eea845cfb26?source=api-prod
- 2024-03-19 MEDIUM: Cross-site Scripting (up to 4.10.16). CVE-2024-29106, https://patchstack.com/database/vulnerability/premium-addons-for-elementor/wordpress-premium-addons-for-elementor-plugin-4-10-16-cross-site-scripting-xss-vulnerability-2?_s_id=cve
- 2024-03-14 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.23). CVE-2024-2399, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc057069-15cd-477f-9106-e616e919c62f?source=api-prod
- 2024-03-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via onClick Events (up to 4.10.18). CVE-2024-0326, https://www.wordfence.com/threat-intel/vulnerabilities/id/61bac919-90be-4fb5-859a-d135e87fe0bb?source=api-prod
- 2024-02-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets (up to 4.10.21). CVE-2024-1680, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2d0b38-8241-456f-a79b-5d31132b3233?source=api-prod
- 2024-02-14 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.18). CVE-2024-1242, https://www.wordfence.com/threat-intel/vulnerabilities/id/1026b753-e82b-4fa3-9023-c36ab9863b29?source=api-prod
- 2024-02-02 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.10.16). CVE-2024-24831, https://www.wordfence.com/threat-intel/vulnerabilities/id/f7222c7e-939a-4666-9d01-f715d2827954?source=api-prod
- 2021-08-30 MEDIUM: Authenticated (Subscriber+) Limited Arbitrary Option Update (up to 4.5.1). CVE-2021-4445, https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb26bc-3d3f-4593-bb36-d2abcd67861e?source=api-prod
- 2021-04-13 MEDIUM: Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting (before 4.2.8). CVE-2021-24257, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e45ac7f-faab-4004-8c1b-b9b68f9dfe4c?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=premium-addons-for-elementor · HTML: https://todaywp.com/plugins/premium-addons-for-elementor