Software intelligence

Bdthemes Element Pack Lite vulnerabilities

42 tracked advisories · slug bdthemes-element-pack-lite

Important: Bdthemes Element Pack Lite appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works

Tracked advisories

Latest advisory

8 August 2026

CISA KEV matches

In this WordPress feed

WordPress slug

bdthemes-element-pack-lite

Plugin

What this means for Bdthemes Element Pack Lite

This catalog lists 42 known advisories affecting Bdthemes Element Pack Lite. The most recent was published on 8 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.

Latest issues

Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
May allow attackers to run scripts in visitors' browsers or hijack admin sessions.
Published 8 August 2026
Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 6 August 2026
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons < 8.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
May allow attackers to run scripts in visitors' browsers or hijack admin sessions.
Published 2 August 2026

Vulnerability types

Cross-site scripting30
SQL injection2
CSRF1

Authentication (inferred from titles)

Unauthenticated1
Authenticated34
Unspecified7

Advisory history

Known Bdthemes Element Pack Lite advisories published by month.

Oct 25

Nov 25

Dec 25

Jan 26

Feb 26

Mar 26

Apr 26

May 26

Jun 26

Jul 26

Aug 26

Sept 26

All advisories

Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-12851 · Published 7 January 2025
Affected versions: ≤ 5.10.14
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization
CVE-2024-11852 · Published 21 December 2024
Affected versions: ≤ 5.10.12
Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget
CVE-2024-9058 · Published 2 December 2024
Affected versions: ≤ 5.10.5
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent'
CVE-2024-10980 · Published 14 November 2024
Affected versions: ≤ 5.10.2
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-10493 · Published 7 November 2024
Affected versions: ≤ 5.10.2
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
CVE-2024-9657 · Published 4 November 2024
Affected versions: ≤ 5.10.2
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget
CVE-2024-9867 · Published 4 November 2024
Affected versions: ≤ 5.10.2
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget
CVE-2024-10310 · Published 1 November 2024
Affected versions: ≤ 5.10.1
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
CVE-2024-9868 · Published 1 November 2024
Affected versions: ≤ 5.10.1
Element Pack Elementor Addons <= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-47392 · Published 30 September 2024
Affected versions: ≤ 5.7.5
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets
CVE-2024-7247 · Published 12 August 2024
Affected versions: ≤ 5.7.2
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag
CVE-2024-4360 · Published 8 August 2024
Affected versions: ≤ 5.7.6
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
CVE-2024-4359 · Published 8 August 2024
Affected versions: ≤ 5.7.2
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-4643 · Published 1 August 2024
Affected versions: ≤ 5.6.11
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-5554 · Published 17 July 2024
Affected versions: ≤ 5.6.11

16–30 of 42

2 / 3

Check whether your installed version is affected

SiteRespond Defence matches your installed Bdthemes Element Pack Lite version against this catalog when the Defence plugin is connected to your WordPress site.

Start SiteRespond Defence for WordPress — £29.99/monthScan your website