PLUGIN SECURITY
Is Themesflat Addons For Elementor safe?
Themesflat Addons For Elementor plugin you install after Elementor!. Themesflat addon focuses on support for the author build Template Kits
What this plugin does
- Slug:
themesflat-addons-for-elementor - Author: Themesflat
- 40000+ active installs
- 40/100 rating (9 reviews on wordpress.org)
- 714975 all-time downloads
- On WordPress.org since 2020-07-21
addonselementorelementor addonthemesflatwidget
Maintenance status
- Latest known version: 2.3.3
- Last updated: 2026-03-13 2:38am GMT
- Tested up to WordPress: 6.9.7
- Requires PHP: 5.2+
Known vulnerabilities
14 known CVEs on file for Themesflat Addons For Elementor.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-39500 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.3.3 | — | Medium 6.5 | < 2.3.3 | 2.3.3 | 2026-03-23 | ✓ fixed in latest |
| CVE-2025-31567 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.3.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.3.2 | 2.3.2 | 2025-03-31 | ✓ fixed in latest |
| CVE-2024-12205 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.2.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.2.5 | 2.2.5 | 2025-01-07 | ✓ fixed in latest |
| CVE-2024-53796 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.2.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.2.3 | 2.2.3 | 2024-12-02 | ✓ fixed in latest |
| CVE-2024-49310 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.2.2 | 2.2.2 | 2024-10-15 | ✓ fixed in latest |
| CVE-2024-8515 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.2.2 | 2.2.2 | 2024-09-24 | ✓ fixed in latest |
| CVE-2024-8516 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.2.2 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 2.2.2 | 2.2.2 | 2024-09-24 | ✓ fixed in latest |
| CVE-2024-2922 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.3 | 2.1.3 | 2024-06-05 | ✓ fixed in latest |
+ 7 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-4459 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.3 | 2.1.3 | 2024-06-05 | ✓ fixed in latest |
| CVE-2024-4212 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.3 | 2.1.3 | 2024-06-05 | ✓ fixed in latest |
| CVE-2024-4458 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.3 | 2.1.3 | 2024-06-05 | ✓ fixed in latest |
| CVE-2024-35666 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.3 | 2.1.3 | 2024-06-03 | ✓ fixed in latest |
| CVE-2023-37390 | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.0.1 | Deserialization of Untrusted Data | High 8.3 | < 2.0.1 | 2.0.1 | 2023-08-07 | ✓ fixed in latest |
| — | Themesflat Addons For Elementor [themesflat-addons-for-elementor] < 2.2.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.2.6 | 2.2.6 | 0000-00-00 | ✓ fixed in latest |
| CVE-2025-3275 | Themesflat Addons For Elementor < 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting | — | Unknown | < 2.2.6 | 2.2.6 | — | ✓ fixed in latest |
How to fix it
Keep Themesflat Addons For Elementor updated — 2.3.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7297)
- Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder — 2000000+ active installs — 98/100 (2525) — max PHP 8.4
- Essential Addons for Elementor – Popular Elementor Templates & Widgets — 1000000+ active installs — 98/100 (4112) — max PHP 8.4
- Starter Templates – AI-Powered Templates for Elementor & Gutenberg — 1000000+ active installs — 98/100 (4745) — max PHP 8.4
- Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools — 600000+ active installs — 98/100 (1677) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.