tadrik Free store check

Plugin security / Essential Addons for Elementor

Essential Addons for Elementor vulnerability: is your WooCommerce store affected?

Essential Addons for Elementor has 9 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 28 October 2026. Every one is fixed: update to 6.8.8 or newer.

Short answer: your store is affected if it runs Essential Addons for Elementor older than 6.8.8. Update to 6.8.8 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 81 were running a version of Essential Addons for Elementor with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 7.4 (high)no login neededAffected: older than 6.8.8Fixed in 6.8.8Published 28 October 2026CVE-2026-118205

    Advisory: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the...

  2. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 8.8 (high)needs only a customer accountAffected: older than 6.6.11Fixed in 6.6.11Published 10 July 2026CVE-2026-15155

    Advisory: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10...

  3. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 6.0.15Fixed in 6.0.15Published 4 February 2025CVE-2025-24752

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue...

  4. PHP object injection

    In some setups, someone could make your server run code.

    Score 8.8 (high)needs only a customer accountAffected: older than 5.9.14Fixed in 5.9.14Published 29 March 2024CVE-2024-3018

    Advisory: The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword'...

  5. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.4 (high)needs only a customer accountAffected: older than 5.9.10Fixed in 5.9.10Published 11 March 2024CVE-2024-1536

    Advisory: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all...

  6. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 8.8 (high)needs only a customer accountAffected: older than 5.8.9Fixed in 5.8.9Published 14 September 2023CVE-2023-41955

    Advisory: Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.

  7. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 9.8 (critical)no login neededAffected: older than 5.7.2Fixed in 5.7.2Published 11 May 2023CVE-2023-32243

    Advisory: Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.

2 older holes, published before 1 January 2023

  1. Code execution

    Someone could run their own code on your server.

    Score 9.8 (critical)no login neededAffected: older than 5.0.9Fixed in 5.0.9Published 21 January 2022CVE-2022-0320

    Advisory: The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local...

  2. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 8.8 (high)needs only a customer accountAffected: older than 4.6.5Fixed in 4.6.5Published 5 May 2021CVE-2021-4447

    Advisory: The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom...

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find Essential Addons for Elementor. The version number is under its name. If it is lower than 6.8.8, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/essential-addons-for-elementor-lite/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update Essential Addons for Elementor to 6.8.8 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Essential Addons for Elementor.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use Essential Addons for Elementor, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which Essential Addons for Elementor version fixes it?
Version 6.8.8 or newer fixes all 9 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs Essential Addons for Elementor older than 6.8.8. In WordPress, open Plugins and read the version under Essential Addons for Elementor. Without logging in, open yourstore.com/wp-content/plugins/essential-addons-for-elementor-lite/readme.txt and read the Stable tag line.
I don't use Essential Addons for Elementor any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.