Exclusive Addons for Elementor Vulnerability – Authenticated Contributor+ Stored Cross-Site Scripting – CVE-2024-1234 | WordPress Plugin Vulnerability Report

Plugin Name: Exclusive Addons for Elementor

Key Information:

  • Software Type: Plugin
  • Software Slug: exclusive-addons-for-elementor
  • Software Status: Active
  • Software Author: timstrifler
  • Software Downloads: 717,031
  • Active Installs: 60,000
  • Last Updated: March 1, 2024
  • Patched Versions:
  • Affected Versions: <= 2.6.9

Vulnerability Details:

  • Name: Exclusive Addons for Elementor <= 2.6.9
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1234
  • CVSS Score: 6.4
  • Publicly Published: March 1, 2024
  • Researcher: Webbernaut
  • Description: The Exclusive Addons for Elementor plugin, a popular enhancement for the Elementor page builder, has been identified with a Stored Cross-Site Scripting (XSS) vulnerability in its data attribute handling. In versions up to and including 2.6.9, the plugin fails to properly sanitize and escape input, allowing authenticated users with at least contributor-level permissions to inject malicious scripts. These scripts can execute on the pages viewed by other users, compromising site integrity and user security.


Exclusive Addons for Elementor harbors a vulnerability in versions up to 2.6.9, where insufficient input sanitization enables Stored XSS attacks by users with contributor-level access or higher. This security flaw has been addressed in the patched version, mitigating the associated risks.

Detailed Overview:

This vulnerability, discovered by security researcher Webbernaut, highlights the critical need for strict input validation and output encoding within WordPress plugins, especially those that offer extensive customization options like Exclusive Addons for Elementor. The potential for malicious script injection poses a significant threat to both website operators and visitors, underlining the importance of maintaining a secure web environment. The release of patch by the plugin developers serves as a proactive measure to secure websites against the exploitation of this vulnerability.

Advice for Users:

  • Immediate Action: Users of Exclusive Addons for Elementor are strongly advised to update to the latest patched version,, immediately to protect their sites from potential XSS attacks.
  • Check for Signs of Vulnerability: Website administrators should remain vigilant for any unusual or unauthorized changes to their sites, which may indicate the exploitation of this vulnerability.
  • Alternate Plugins: While the patched version rectifies this issue, exploring alternative plugins that consistently demonstrate robust security measures can offer an added layer of protection.
  • Stay Updated: Regular updates are essential to web security. Ensuring that all WordPress plugins and themes are up-to-date is crucial in defending against known vulnerabilities and maintaining a secure online presence.


The prompt identification and remediation of the Stored Cross-Site Scripting vulnerability in Exclusive Addons for Elementor underscore the ongoing challenge of safeguarding digital platforms against emerging threats. This incident serves as a critical reminder of the importance of regular software updates and diligent security practices in preserving the safety and trustworthiness of WordPress sites. For small business owners and website operators, prioritizing these practices is indispensable in protecting their digital assets and maintaining the confidence of their users.


In the digital era, where online presence is integral to business success, the recent discovery of a vulnerability within the Exclusive Addons for Elementor plugin, identified as CVE-2024-1234, underscores the critical need for vigilant web security practices. This vulnerability exposes the inherent risks plugins can pose and highlights the importance of timely updates to safeguard online assets.

Exclusive Addons for Elementor: A Cornerstone Plugin

The Exclusive Addons for Elementor plugin enhances the Elementor page builder's capabilities, offering custom widgets and modules to enrich WordPress sites. With over 717,031 downloads and active installations numbering 60,000, its impact on the WordPress community is significant. The plugin's development by timstrifler has seen it become a favorite tool for site customization, underlining the importance of its security for a vast user base.

The Vulnerability: CVE-2024-1234

CVE-2024-1234 is a Stored Cross-Site Scripting (XSS) vulnerability arising from the plugin's failure to properly sanitize and escape user inputs in its data attributes. Versions up to 2.6.9 are affected, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts, once executed, can modify site content or compromise user data, posing a severe security risk. The vulnerability was publicly disclosed on March 1, 2024, by the researcher Webbernaut, drawing immediate attention to the need for a resolution.

Risks and Potential Impacts

The risks associated with CVE-2024-1234 are multifaceted, threatening not only site integrity but also user privacy and data security. Malicious scripts can lead to unauthorized data access, theft of sensitive information, and the potential for widespread malware distribution. For small business owners, such vulnerabilities can erode customer trust, incur legal liabilities, and result in significant financial losses.

Remediation and Mitigation

In response to CVE-2024-1234, the developers released patch, effectively closing the vulnerability. Users are urged to update immediately to this version to protect their sites. Additionally, site administrators should remain vigilant for any signs of compromise, such as unexpected site behavior or unauthorized content changes, and consider employing security plugins to monitor for potential threats.

Historical Context

This is not the first challenge faced by Exclusive Addons for Elementor; with eight previous vulnerabilities reported since December 14, 2022, the plugin's security history underscores the ongoing battle against digital threats and the importance of continuous monitoring and updating.

The Importance of Proactive Security Measures

The identification and swift resolution of CVE-2024-1234 within Exclusive Addons for Elementor serve as a potent reminder of the ever-present cyber threats in the digital landscape. For small business owners, the incident highlights the critical nature of maintaining updated and secure software. In an age where online vulnerabilities can have far-reaching consequences, the commitment to regular software updates and diligent security practices is indispensable in protecting digital assets and sustaining user trust.

In conclusion, staying ahead of security vulnerabilities is not just a technical necessity but a fundamental business practice that ensures the longevity and reliability of your digital presence. Regular updates, coupled with proactive security measures, form the bedrock of a secure and trusted online environment, safeguarding your business and your customers in the interconnected digital world.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.


Exclusive Addons for Elementor Vulnerability – Authenticated Contributor+ Stored Cross-Site Scripting – CVE-2024-1234 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment