Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget
medium
The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-lev...
- CVSS:
- 6.4
- Affected:
- up to 1.5.5
- Fixed in:
- 1.5.6
- Disclosed:
- Dec 11, 2025
CVE-2025-12830 on NVD →
Better Elementor Addons <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...
- CVSS:
- 6.4
- Affected:
- up to 1.4.4
- Fixed in:
- 1.4.5
- Disclosed:
- May 7, 2024
CVE-2024-34432 on NVD →
Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Local File Inclusion
high
The Better Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in...
- CVSS:
- 8.8
- Affected:
- up to 1.4.1
- Fixed in:
- 1.4.2
- Disclosed:
- Apr 25, 2024
CVE-2024-33541 on NVD →
Better Elementor Addons <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...
- CVSS:
- 6.4
- Affected:
- up to 1.3.7
- Fixed in:
- 1.3.8
- Disclosed:
- Mar 28, 2024
CVE-2024-30423 on NVD →
Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
medium
The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contrib...
- CVSS:
- 6.4
- Affected:
- up to 1.4.1
- Fixed in:
- 1.4.2
- Disclosed:
- Mar 28, 2024
CVE-2024-2280 on NVD →
Better Elementor Addons <= 1.3.8 - Missing Authorization
medium
The Better Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bea_admin_ajax() function hooked via an AJAX action in versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with subscriber-level access and a...
- CVSS:
- 4.3
- Affected:
- up to 1.3.8
- Fixed in:
- 1.3.9
- Disclosed:
- Sep 1, 2023
CVE-2023-41656 on NVD →
Freemius SDK <= 2.4.2 - Missing Authorization Checks
medium
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
- CVSS:
- 6.3
- Affected:
- up to 1.3.1
- Fixed in:
- 1.3.1
- Disclosed:
- Mar 4, 2022
CVE-2022-4974 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database