Premium Addons for Elementor – Authenticated Stored Cross-Site Scripting via Link Wrapper – CVE-2024-0326 | WordPress Plugin Vulnerability Report

Plugin Name: Premium Addons for Elementor

Key Information:

  • Software Type: Plugin
  • Software Slug: premium-addons-for-elementor
  • Software Status: Active
  • Software Author: leap13
  • Software Downloads: 30,089,290
  • Active Installs: 700,000
  • Last Updated: March 13, 2024
  • Patched Versions: 4.0.18
  • Affected Versions: <= 4.0.17

Vulnerability Details:

  • Name: Premium Addons for Elementor <= 4.0.17
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Link Wrapper
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-0326
  • CVSS Score: 6.4
  • Publicly Published: March 12, 2024
  • Researcher: Webbernaut
  • Description: The Premium Addons for Elementor plugin has been found vulnerable to Stored Cross-Site Scripting (XSS) through its Link Wrapper feature, present in all versions up to and including 4.0.17. Due to inadequate input sanitization and output escaping, authenticated attackers with contributor-level access or higher can exploit this to inject and execute malicious scripts on web pages.


Premium Addons for Elementor, a widely utilized plugin offering advanced addons and widgets for Elementor users, faces a security risk in versions up to 4.0.17. This vulnerability, identified as CVE-2024-0326, enables authenticated Stored Cross-Site Scripting attacks via the Link Wrapper functionality, compromising site security. The vulnerability has been addressed in the subsequent release, version 4.0.18.

Detailed Overview:

Discovered by researcher Webbernaut, CVE-2024-0326 underscores the critical importance of rigorous input validation and encoding practices in web development, particularly for plugins that allow user-generated content. The potential exploitation of this vulnerability highlights the need for stringent security measures and vigilant monitoring of user roles and permissions within WordPress environments.

Advice for Users:

  • Immediate Action: To mitigate the risk posed by CVE-2024-0326, users should immediately update the Premium Addons for Elementor plugin to version 4.0.18.
  • Check for Signs of Vulnerability: Site administrators are advised to review their websites for unusual or unauthorized content changes, which could indicate the exploitation of this vulnerability.
  • Alternate Plugins: While the updated version is secure, users may consider exploring alternative Elementor addons to ensure diversified security features or functionalities.
  • Stay Updated: Regular updates of all WordPress components, including plugins and themes, are essential for safeguarding against known vulnerabilities and optimizing website performance.


The resolution of CVE-2024-0326 within Premium Addons for Elementor serves as a crucial reminder of the ever-present need for cybersecurity vigilance in the WordPress community. For small business owners and website administrators, especially those with limited technical support, the commitment to regular software updates and adherence to security best practices is paramount in protecting digital assets and maintaining a secure online presence.


In today's digital age, the security of online platforms is paramount, particularly for small business owners leveraging WordPress for their websites. A recent vulnerability discovered in the popular "Premium Addons for Elementor" plugin underscores the critical need for constant vigilance and prompt action in the face of emerging threats. This blog post delves into the specifics of the vulnerability, its potential impacts, and the steps necessary to mitigate the risk, reinforcing the importance of regular updates and cybersecurity awareness.

Plugin Overview:

"Premium Addons for Elementor" is an essential tool for over 700,000 WordPress sites, providing a suite of advanced addons and widgets to enhance the Elementor page builder experience. Developed by Leap13, this plugin has seen over 30 million downloads, testament to its widespread use and utility.

Risks and Impacts:

The exploitation of this vulnerability could lead to several security issues, including unauthorized data access, website defacement, and the potential dissemination of malware, jeopardizing both site integrity and user trust.

Remediation Steps:

To safeguard against this vulnerability, users are urged to update the plugin to the latest version, 4.0.18, immediately. Additionally, conducting regular audits for unusual site behavior and content changes is crucial for early detection of potential exploits.

Historical Context:

This is not the first vulnerability identified in the "Premium Addons for Elementor" plugin, with six previous issues reported since April 13, 2021. Each incident serves as a learning opportunity, contributing to the ongoing improvement of security practices.


The swift resolution of CVE-2024-0326 is a testament to the WordPress community's commitment to security. However, it also serves as a stark reminder of the perpetual nature of cybersecurity threats. For small business owners, staying informed about vulnerabilities and maintaining up-to-date plugins and themes is not just a best practice but a necessity. Proactive security measures, including regular updates and user role management, are key to ensuring a secure and reliable online presence.

By understanding the implications of such vulnerabilities and taking decisive action, small business owners can better protect their digital assets, ensuring their WordPress sites remain secure, functional, and trustworthy.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Premium Addons for Elementor – Authenticated Stored Cross-Site Scripting via Link Wrapper – CVE-2024-0326 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment