¿Es seguro Piotnet Addons For Elementor?

Qué hace este plugin

• Slug: piotnet-addons-for-elementor
• 30000+ instalaciones activas

elementor addonsgradient buttongradient textimage carousel multiple custom urlspafe

Estado de mantenimiento

• Última versión conocida: 2.4.37
• Requiere PHP: 5.4+

Vulnerabilidades conocidas

9 CVEs conocidos registrados para Piotnet Addons For Elementor.

Piotnet Addons For Elementor [piotnet-addons-for-elementor] <= 2.4.36 (unfixed)

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Piotnet Addons For Elementor [piotnet-addons-for-elementor] <= 2.4.36 (unfixed)

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-10775

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-22333

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Heading widget in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-5502

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical Timeline widgets in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-5614

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafe_posts_list' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of future, draft, and pending blog posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4262

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4432

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 3 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-33630	Piotnet Addons For Elementor [piotnet-addons-for-elementor] < 2.4.27	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,5	< 2.4.27	2.4.27	2024-04-25	✓ corregido en la última versión
CVE-2024-29934	Piotnet Addons For Elementor [piotnet-addons-for-elementor] < 2.4.26	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,5	< 2.4.26	2.4.26	2024-03-25	✓ corregido en la última versión
CVE-2024-9673	Piotnet Addons For Elementor [piotnet-addons-for-elementor] < 2.4.32	—	Desconocido	< 2.4.32	2.4.32	0000-00-00	✓ corregido en la última versión

CVE-2024-33630

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-29934

Update the WordPress Piotnet Addons For Elementor plugin to the latest available version (at least 2.4.26). Abu Hurayra discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Piotnet Addons For Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.4.26. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-9673

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Heading widget in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Piotnet Addons For Elementor actualizado — 2.4.37 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Ultimate Addons for Elementor — 2000000+ instalaciones activas — 98/100 (2524) — PHP máx. 8.4
• Essential Addons for Elementor – Popular Elementor Templates & Widgets — 2000000+ instalaciones activas — 98/100 (4090) — PHP máx. 8.4
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — 1000000+ instalaciones activas — 98/100 (2023) — PHP máx. 8.4
• Premium Addons for Elementor – Powerful Elementor Templates & Widgets — 700000+ instalaciones activas — 98/100 (1675) — PHP máx. 8.4
• Royal Addons for Elementor – Addons and Templates Kit for Elementor — 600000+ instalaciones activas — 96/100 (609)