Now officially on WordPress.org

CVE Database / CVE-2024-11937

CVE · Medium

CVE-2024-11937 — Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools [premium-addons-for-elementor] < 4.10.70

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-11937 Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools [premium-addons-for-elementor] < 4.10.70 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.4 < 4.10.70 4.10.70 2025-07-03 —

CVE-2024-11937

The Premium Addons for Elementor plugin is susceptible to stored cross-site scripting through the linkURL parameter in its Mobile Menu element in versions up to 4.10.69. The vulnerability stems from inadequate sanitization of user input and lack of proper output encoding for element attributes. Attackers with contributor access or higher permissions can insert malicious scripts into pages, which will run when visitors view those pages.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings