Plugin vulnerabilities
Is ElementsKit safe? Known vulnerabilities and the version to run.
ElementsKit Elementor Addons: adds extra widgets, a mega menu and header and footer builders to Elementor.
The short answer
Run ElementsKit 4.0.7 or later. That version has a fix for every known vulnerability that's been patched.
- Known vulnerabilities
- 31
- In the last 12 months
- 10
- Rated high or critical
- 3
- No fix yet
- 0
Every known ElementsKit vulnerability
Newest first. The most recent was disclosed on 1 October 2026. Each one links to its full record on Wordfence.
| Vulnerability | Severity | Affected versions | Fixed in |
|---|---|---|---|
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-103063 · 1 October 2026 | Medium 6.4 | 4.0.6 and earlier | 4.0.7 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-103064 · 1 October 2026 | Medium 6.4 | 4.0.6 and earlier | 4.0.7 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-94500 · 23 September 2026 | Medium 6.4 | 4.0.5 and earlier | 4.0.6 |
| Authenticated (Admin+) Remote Code ExecutionCVE-2026-13392 · 4 August 2026 | High 7.2 | before 3.10.01 | 3.10.01 |
| Authenticated (Subsite administrator+) Stored Cross-Site ScriptingCVE-2026-13393 · 14 July 2026 | Medium 6.4 | 3.10.0 and earlier | 3.10.01 |
| Missing AuthorizationCVE-2026-49052 · 27 May 2026 | Medium 4.3 | 3.9.6 and earlier | 3.9.7 |
| Missing AuthorizationCVE-2026-49053 · 27 May 2026 | Medium 5.3 | 3.9.6 and earlier | 3.9.7 |
| Missing Authorization to Unauthenticated Widget Content OverwriteCVE-2026-4362 · 4 May 2026 | Medium 6.5 | 3.8.2 and earlier | 3.9.0 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab WidgetCVE-2026-2600 · 3 April 2026 | Medium 6.4 | 3.7.9 and earlier | 3.8.0 |
| Missing AuthorizationCVE-2026-23693 · 24 February 2026 | Medium 5.3 | before 3.7.9 | 3.7.9 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Custom WidgetCVE-2025-3614 · 24 July 2025 | Medium 6.4 | 3.5.2 and earlier | 3.5.3 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetCVE-2025-4479 · 18 June 2025 | Medium 6.4 | 3.5.2 and earlier | 3.5.3 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-11180 · 28 March 2025 | Medium 6.4 | 3.4.7 and earlier | 3.4.8 |
| Unauthenticated Information Exposure via get_megamenu_content FunctionCVE-2025-0968 · 18 February 2025 | Medium 5.3 | 3.4.0 and earlier | 3.4.1 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetCVE-2025-1005 · 14 February 2025 | Medium 6.4 | 3.4.0 and earlier | 3.4.1 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetCVE-2024-10091 · 25 October 2024 | Medium 6.4 | 3.2.9 and earlier | 3.3.0 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetCVE-2024-8546 · 24 September 2024 | Medium 6.4 | 3.2.7 and earlier | 3.2.8 |
| Unauthenticated Information Exposure via ekit_widgetarea_content FunctionCVE-2024-6455 · 18 July 2024 | Medium 5.3 | 3.2.0 and earlier | 3.2.1 |
| Missing AuthorizationCVE-2024-37255 · 27 June 2024 | Medium 5.3 | 3.1.4 and earlier | 3.2.0 |
| ElementsKit Elementor addons 3.0.7 - 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetCVE-2024-3650 · 30 April 2024 | Medium 6.4 | 3.0.7 to 3.1.2 | 3.1.3 |
| Authenticated (Contributor+) Local File Inclusion via Onepage Scroll ModuleCVE-2024-3499 · 22 April 2024 | High 8.8 | 3.1.0 and earlier | 3.1.1 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-32505 · 15 April 2024 | Medium 6.4 | 3.0.6 and earlier | 3.0.7 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetCVE-2024-2803 · 3 April 2024 | Medium 6.4 | 3.0.7 and earlier | 3.1.0 |
| Authenticated (Contributor+) Local File Inclusion in render_rawCVE-2024-2047 · 29 March 2024 | High 8.8 | 3.0.6 and earlier | 3.0.7 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-1238 · 29 March 2024 | Medium 6.4 | 3.0.6 and earlier | 3.0.7 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-1239 · 15 March 2024 | Medium 6.4 | 3.0.4 and earlier | 3.0.5 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetCVE-2024-2042 · 15 March 2024 | Medium 6.4 | 3.0.5 and earlier | 3.0.6 |
| Authenticated(Editor+) Stored Cross-Site ScriptingCVE-2023-6525 · 15 March 2024 | Medium 5.5 | 3.0.3 and earlier | 3.0.4 |
| Unauthenticated Sensitive Information ExposureCVE-2023-6582 · 8 January 2024 | Medium 5.3 | 3.0.3 and earlier | 3.0.4 |
| Missing AuthorizationCVE-2023-39993 · 23 August 2023 | Medium 5.4 | 2.9.1 and earlier | 2.9.2 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2021-24258 · 13 April 2021 | Medium 5.4 | 2.1.7 and earlier | 2.2.0 |
If you run ElementsKit
What to do now
- Check your version. In WordPress, go to Plugins and look under ElementsKit. Compare it with the affected versions above.
- Update to 4.0.7 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
- Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.
Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.
Page builders and add-ons
Related plugins
Elementor Pro
The paid version of Elementor, adding theme building, forms, popups and WooCommerce widgets.
17 known1 in the last year
Elementor
A drag-and-drop page builder, and one of the most widely used plugins on WordPress.
61 known18 in the last year
Starter Templates
Imports ready-made site designs for the Astra theme and popular page builders.
12 known4 in the last year
Essential Addons
A collection of extra widgets and extensions for the Elementor page builder.
76 known24 in the last year
Spectra
Adds extra blocks and layout tools to the WordPress block editor.
33 known9 in the last year
Kadence Blocks
Adds layout and design blocks to the WordPress block editor.
43 known16 in the last year
Data sources and licences
Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Not sure yet?
Find out how exposed your site is.
Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.
- Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
- WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
- 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix