¿Es seguro Premium Addons Pro?

Qué hace este plugin

• Slug: premium-addons-pro
• Autor: Leap13
• 700000+ instalaciones activas
• 98/100 calificación (1675 reseñas en wordpress.org)
• 62009925 descargas totales
• En WordPress.org desde 2018-01-09

elementorelementor addonselementor mega menuelementor templateselementor widgets

Estado de mantenimiento

• Última actualización: 2026-07-20 10:57am GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

9 CVEs conocidos registrados para Premium Addons Pro. Reportadas entre 2023 y 2024.

CVE-2024-2239

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2238

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1997

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Messenger Chat Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2000

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Scroll Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2237

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1996

Update the WordPress Premium Addons PRO plugin to the latest available version (at least 2.9.13). wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons PRO Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.9.13. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-37869

The Premium Addons PRO plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on one of its functions in versions up to, and including, 2.9.0. This makes it possible for authenticated attackers, with contributor-level access and above, to make use of this functionality intended for users with higher privileges.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-37868

No patched version is available. Rafie Muhammad (Patchstack) discovered and reported this Sensitive Data Exposure vulnerability in WordPress Premium Addons PRO Plugin. This vulnerability has not been known to be fixed yet.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 1 vulnerabilidad conocida más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-34012	Premium Addons Pro for Elementor [premium-addons-pro] < 2.8.25	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 2.8.25	2.8.25	2023-06-02	—

CVE-2023-34012

Update the WordPress Premium Addons PRO plugin to the latest available version (at least 2.8.25). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons PRO Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.8.25.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Elementor Website Builder – more than just a page builder — 10000000+ instalaciones activas — 90/100 (7281)
• Ultimate Addons for Elementor — 2000000+ instalaciones activas — 98/100 (2524) — PHP máx. 8.4
• Essential Addons for Elementor – Popular Elementor Templates & Widgets — 2000000+ instalaciones activas — 98/100 (4095) — PHP máx. 8.4
• Starter Templates – AI-Powered Templates for Elementor & Gutenberg — 1000000+ instalaciones activas — 98/100 (4743) — PHP máx. 8.4
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — 1000000+ instalaciones activas — 98/100 (2027) — PHP máx. 8.4