ElementsKit Elementor addons Vulnerability – Authenticated Stored Cross-Site Scripting via Countdown Widget – CVE-2024-2803 | WordPress Plugin Vulnerability Report

Plugin Name: ElementsKit Elementor addons

Key Information:

  • Software Type: Plugin
  • Software Slug: elementskit-lite
  • Software Status: Active
  • Software Author: xpeedstudio
  • Software Downloads: 17,727,023
  • Active Installs: 1,000,000
  • Last Updated: April 3, 2024
  • Patched Versions: 3.1.0
  • Affected Versions: <= 3.0.7

Vulnerability Details:

  • Name: ElementsKit Elementor addons <= 3.0.7
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2803
  • CVSS Score: 6.4
  • Publicly Published: April 3, 2024
  • Researcher: Webbernaut
  • Description: The ElementsKit Elementor addons plugin has been found vulnerable to Stored Cross-Site Scripting (XSS) through its countdown widget feature. Versions up to and including 3.0.7 suffer from insufficient input sanitization and output escaping, allowing authenticated users with contributor access or higher to inject malicious scripts. This flaw can lead to unauthorized script execution when other users access the compromised pages.


The widely utilized ElementsKit Elementor addons plugin, which enhances WordPress sites with additional Elementor widgets and features, faces a significant security challenge with CVE-2024-2803. This vulnerability underscores the necessity of stringent security practices in plugin development and the proactive role users must play in maintaining the security of their WordPress installations by applying updates promptly.

Detailed Overview:

Discovered by the security researcher known as Webbernaut, CVE-2024-2803 presents a tangible risk to WordPress sites utilizing the ElementsKit Elementor addons plugin. The specific exploitation vector lies within the plugin's countdown widget, where inadequate sanitization of user inputs enables the embedding and execution of arbitrary scripts. This vulnerability not only jeopardizes site integrity but also poses a risk to site visitors, potentially exposing them to malicious content and actions.

Advice for Users:

  • Immediate Action: It's imperative for users of the ElementsKit Elementor addons plugin to update to the latest version, 3.1.0, which contains the necessary fixes for this vulnerability.
  • Check for Signs of Vulnerability: Site administrators should review their websites for any unusual or unexpected behavior, especially concerning the countdown widget functionality, to identify potential exploitation.
  • Alternate Plugins: Users concerned about the security of their sites might consider evaluating alternative Elementor addons that offer similar functionality but with a strong emphasis on regular security audits and updates.
  • Stay Updated: The digital landscape's dynamic nature demands vigilance in software maintenance. Regularly updating plugins, themes, and the WordPress core is crucial to safeguard against known vulnerabilities.


The resolution of CVE-2024-2803 in the ElementsKit Elementor addons plugin serves as a stark reminder of the critical importance of software updates in the digital realm. For small business owners who leverage WordPress for their online presence, the incident underscores the dual necessity of relying on reputable plugins and maintaining a rigorous update schedule. In a digital ecosystem where threats continually evolve, the security and reliability of your website hinge on proactive measures and informed decisions.


Detailed Report: 

In the digital age, the security of WordPress sites is paramount, especially with the extensive use of plugins that extend functionality and enhance user experience. One such plugin, ElementsKit Elementor addons, has recently come under scrutiny due to a significant security vulnerability identified as CVE-2024-2803. This vulnerability exposes the delicate balance between functionality and security, underscoring the need for constant vigilance and timely updates.

Plugin Overview:

ElementsKit Elementor addons, developed by xpeedstudio, is a popular plugin offering a range of widgets and modules for Elementor, including the countdown widget implicated in this vulnerability. With an impressive 17,727,023 downloads and 1,000,000 active installations, its impact on the WordPress ecosystem is vast. The plugin's broad adoption makes the discovered vulnerability a concern for a significant portion of the WordPress community.

Vulnerability Insights:

CVE-2024-2803 highlights a Stored Cross-Site Scripting (XSS) issue within the plugin's countdown widget feature. This flaw, present in versions up to 3.0.7, arises from inadequate input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts. The vulnerability was made public on April 3, 2024, by a researcher known as Webbernaut, drawing immediate attention due to its potential implications.

Risks and Implications:

The vulnerability poses significant risks to site integrity and user privacy, as it enables unauthorized script execution, potentially leading to data breaches and compromising site functionality. The nature of XSS attacks means that malicious scripts could be executed unknowingly by site visitors, further amplifying the risk and potential damage.

Remediation and User Guidance:

In response to CVE-2024-2803, the developers released a patched version, 3.1.0, addressing the vulnerability. Users are urged to update their installations immediately to this latest version to mitigate the risks associated with this flaw. Additionally, site administrators should remain vigilant for signs of exploitation and consider employing additional security measures to safeguard their sites.

Historical Context and Previous Vulnerabilities:

This is not the first time vulnerabilities have been discovered in the ElementsKit Elementor addons plugin, with eight previous issues reported since April 13, 2021. Each of these instances serves as a reminder of the ongoing challenges faced in securing WordPress plugins and the importance of maintaining a proactive approach to security.

Conclusion and Key Takeaways for Small Business Owners:

The discovery and subsequent resolution of CVE-2024-2803 in the ElementsKit Elementor addons plugin underscore the critical importance of timely software updates in the digital security landscape. For small business owners, who often manage their WordPress sites amidst numerous other duties, this incident serves as a clarion call to prioritize the security of their online platforms. Staying informed about potential vulnerabilities, ensuring regular updates, and adopting comprehensive security measures are not just best practices but essential strategies for safeguarding your digital presence against the ever-evolving threats in the cyber realm.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

ElementsKit Elementor addons Vulnerability – Authenticated Stored Cross-Site Scripting via Countdown Widget – CVE-2024-2803 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment