Unauthenticated SQL Injection in Essential Addons for Elementor Load More

The unauthenticated Load More and pagination AJAX handlers in Essential Addons for Elementor pass client-supplied query arguments to WP_Query without coercing ID-list values such as author__not_in. On WordPress 6.8 to 7.0.1, whose core does not sanitize a string author__not_in, a visitor can inject SQL into the posts query (blind SQL injection). This patch mirrors the plugin’s 6.6.11 hardening as defense in depth alongside the WordPress core fix.

This vulnerability affects the following application versions:

  • Essential Addons for Elementor 4.3.7
  • Essential Addons for Elementor 4.3.8
  • Essential Addons for Elementor 4.3.9
  • Essential Addons for Elementor 4.4.0
  • Essential Addons for Elementor 4.4.1
  • Essential Addons for Elementor 4.5.0
  • Essential Addons for Elementor 4.5.1
  • Essential Addons for Elementor 4.5.2
  • Essential Addons for Elementor 4.5.3
  • Essential Addons for Elementor 4.5.4
  • Essential Addons for Elementor 4.5.5
  • Essential Addons for Elementor 4.6.0
  • Essential Addons for Elementor 4.6.1
  • Essential Addons for Elementor 4.6.2
  • Essential Addons for Elementor 4.6.3
  • Essential Addons for Elementor 4.6.4
  • Essential Addons for Elementor 4.6.5
  • Essential Addons for Elementor 4.6.6
  • Essential Addons for Elementor 4.7.0
  • Essential Addons for Elementor 4.7.1
  • Essential Addons for Elementor 4.7.2
  • Essential Addons for Elementor 4.7.3
  • Essential Addons for Elementor 4.7.4
  • Essential Addons for Elementor 4.7.5
  • Essential Addons for Elementor 4.8.0
  • Essential Addons for Elementor 4.8.1
  • Essential Addons for Elementor 4.8.2
  • Essential Addons for Elementor 4.8.3
  • Essential Addons for Elementor 4.8.4
  • Essential Addons for Elementor 4.9.0
  • Essential Addons for Elementor 4.9.1
  • Essential Addons for Elementor 4.9.2
  • Essential Addons for Elementor 4.9.3
  • Essential Addons for Elementor 4.9.4
  • Essential Addons for Elementor 4.9.5
  • Essential Addons for Elementor 4.9.6
  • Essential Addons for Elementor 4.9.7
  • Essential Addons for Elementor 5.0.0
  • Essential Addons for Elementor 5.0.1
  • Essential Addons for Elementor 5.0.2
  • Essential Addons for Elementor 5.0.3
  • Essential Addons for Elementor 5.0.4
  • Essential Addons for Elementor 5.0.5
  • Essential Addons for Elementor 5.0.6
  • Essential Addons for Elementor 5.0.7
  • Essential Addons for Elementor 5.0.8
  • Essential Addons for Elementor 5.0.9
  • Essential Addons for Elementor 5.0.10
  • Essential Addons for Elementor 5.0.11
  • Essential Addons for Elementor 5.0.12
  • Essential Addons for Elementor 5.0.13
  • Essential Addons for Elementor 5.1.0
  • Essential Addons for Elementor 5.1.1
  • Essential Addons for Elementor 5.1.2
  • Essential Addons for Elementor 5.1.3
  • Essential Addons for Elementor 5.1.4
  • Essential Addons for Elementor 5.1.5
  • Essential Addons for Elementor 5.1.6
  • Essential Addons for Elementor 5.1.7
  • Essential Addons for Elementor 5.1.8
  • Essential Addons for Elementor 5.1.9
  • Essential Addons for Elementor 5.2.0
  • Essential Addons for Elementor 5.2.1
  • Essential Addons for Elementor 5.2.2
  • Essential Addons for Elementor 5.2.3
  • Essential Addons for Elementor 5.2.4
  • Essential Addons for Elementor 5.3.0
  • Essential Addons for Elementor 5.3.1
  • Essential Addons for Elementor 5.3.2
  • Essential Addons for Elementor 5.4.6
  • Essential Addons for Elementor 5.5.5
  • Essential Addons for Elementor 5.6.5
  • Essential Addons for Elementor 5.7.2
  • Essential Addons for Elementor 5.7.3
  • Essential Addons for Elementor 5.7.4
  • Essential Addons for Elementor 5.8.0
  • Essential Addons for Elementor 5.8.1
  • Essential Addons for Elementor 5.8.2
  • Essential Addons for Elementor 5.8.3
  • Essential Addons for Elementor 5.8.4
  • Essential Addons for Elementor 5.8.5
  • Essential Addons for Elementor 5.8.6
  • Essential Addons for Elementor 5.8.7
  • Essential Addons for Elementor 5.8.8
  • Essential Addons for Elementor 5.8.9
  • Essential Addons for Elementor 5.8.10
  • Essential Addons for Elementor 5.8.11
  • Essential Addons for Elementor 5.8.12
  • Essential Addons for Elementor 5.8.13
  • Essential Addons for Elementor 5.8.14
  • Essential Addons for Elementor 5.8.15
  • Essential Addons for Elementor 5.8.16
  • Essential Addons for Elementor 5.8.18
  • Essential Addons for Elementor 5.9.0
  • Essential Addons for Elementor 5.9.1
  • Essential Addons for Elementor 5.9.2
  • Essential Addons for Elementor 5.9.3
  • Essential Addons for Elementor 5.9.4
  • Essential Addons for Elementor 5.9.5
  • Essential Addons for Elementor 5.9.6
  • Essential Addons for Elementor 5.9.7
  • Essential Addons for Elementor 5.9.8
  • Essential Addons for Elementor 5.9.9
  • Essential Addons for Elementor 5.9.10
  • Essential Addons for Elementor 5.9.11
  • Essential Addons for Elementor 5.9.12
  • Essential Addons for Elementor 5.9.13
  • Essential Addons for Elementor 5.9.14
  • Essential Addons for Elementor 5.9.15
  • Essential Addons for Elementor 5.9.16
  • Essential Addons for Elementor 5.9.17
  • Essential Addons for Elementor 5.9.18
  • Essential Addons for Elementor 5.9.19
  • Essential Addons for Elementor 5.9.20
  • Essential Addons for Elementor 5.9.21
  • Essential Addons for Elementor 5.9.22
  • Essential Addons for Elementor 5.9.23
  • Essential Addons for Elementor 5.9.24
  • Essential Addons for Elementor 5.9.25
  • Essential Addons for Elementor 5.9.26
  • Essential Addons for Elementor 5.9.27
  • Essential Addons for Elementor 6.0.0
  • Essential Addons for Elementor 6.0.1
  • Essential Addons for Elementor 6.0.2
  • Essential Addons for Elementor 6.0.3
  • Essential Addons for Elementor 6.0.4
  • Essential Addons for Elementor 6.0.5
  • Essential Addons for Elementor 6.0.6
  • Essential Addons for Elementor 6.0.7
  • Essential Addons for Elementor 6.0.8
  • Essential Addons for Elementor 6.0.9
  • Essential Addons for Elementor 6.0.10
  • Essential Addons for Elementor 6.0.11
  • Essential Addons for Elementor 6.0.12
  • Essential Addons for Elementor 6.0.13
  • Essential Addons for Elementor 6.0.14
  • Essential Addons for Elementor 6.0.15
  • Essential Addons for Elementor 6.1.0
  • Essential Addons for Elementor 6.1.1
  • Essential Addons for Elementor 6.1.2
  • Essential Addons for Elementor 6.1.3
  • Essential Addons for Elementor 6.1.4
  • Essential Addons for Elementor 6.1.5
  • Essential Addons for Elementor 6.1.6
  • Essential Addons for Elementor 6.1.7
  • Essential Addons for Elementor 6.1.8
  • Essential Addons for Elementor 6.1.9
  • Essential Addons for Elementor 6.1.10
  • Essential Addons for Elementor 6.1.11
  • Essential Addons for Elementor 6.1.12
  • Essential Addons for Elementor 6.1.13
  • Essential Addons for Elementor 6.1.14
  • Essential Addons for Elementor 6.1.15
  • Essential Addons for Elementor 6.1.17
  • Essential Addons for Elementor 6.1.18
  • Essential Addons for Elementor 6.1.19
  • Essential Addons for Elementor 6.1.20
  • Essential Addons for Elementor 6.2.0
  • Essential Addons for Elementor 6.2.1
  • Essential Addons for Elementor 6.2.2
  • Essential Addons for Elementor 6.2.3
  • Essential Addons for Elementor 6.2.4
  • Essential Addons for Elementor 6.3.0
  • Essential Addons for Elementor 6.3.1
  • Essential Addons for Elementor 6.3.2
  • Essential Addons for Elementor 6.3.3
  • Essential Addons for Elementor 6.4.0
  • Essential Addons for Elementor 6.5.0
  • Essential Addons for Elementor 6.5.1
  • Essential Addons for Elementor 6.5.2
  • Essential Addons for Elementor 6.5.3
  • Essential Addons for Elementor 6.5.4
  • Essential Addons for Elementor 6.5.5
  • Essential Addons for Elementor 6.5.6
  • Essential Addons for Elementor 6.5.7
  • Essential Addons for Elementor 6.5.8
  • Essential Addons for Elementor 6.5.9
  • Essential Addons for Elementor 6.5.10
  • Essential Addons for Elementor 6.5.11
  • Essential Addons for Elementor 6.5.12
  • Essential Addons for Elementor 6.5.13
  • Essential Addons for Elementor 6.6.0
  • Essential Addons for Elementor 6.6.1
  • Essential Addons for Elementor 6.6.2
  • Essential Addons for Elementor 6.6.3
  • Essential Addons for Elementor 6.6.4
  • Essential Addons for Elementor 6.6.5
  • Essential Addons for Elementor 6.6.6
  • Essential Addons for Elementor 6.6.7
  • Essential Addons for Elementor 6.6.8
  • Essential Addons for Elementor 6.6.9
  • Essential Addons for Elementor 6.6.10

Missing Authorization in Essential Addons for Elementor AJAX Actions

Up to version 4.6.4, several Essential Addons for Elementor AJAX actions check only a nonce that the plugin prints on public pages, not the user’s capability. Any logged-in user, such as a subscriber, can install and activate plugins, change the plugin’s settings and clear its asset cache.

This vulnerability affects the following application versions:

  • Essential Addons for Elementor 4.3.2
  • Essential Addons for Elementor 4.3.3
  • Essential Addons for Elementor 4.3.4
  • Essential Addons for Elementor 4.3.5
  • Essential Addons for Elementor 4.3.6
  • Essential Addons for Elementor 4.3.7
  • Essential Addons for Elementor 4.3.8
  • Essential Addons for Elementor 4.3.9
  • Essential Addons for Elementor 4.4.0
  • Essential Addons for Elementor 4.4.1
  • Essential Addons for Elementor 4.5.0
  • Essential Addons for Elementor 4.5.1
  • Essential Addons for Elementor 4.5.2
  • Essential Addons for Elementor 4.5.3
  • Essential Addons for Elementor 4.5.4
  • Essential Addons for Elementor 4.5.5
  • Essential Addons for Elementor 4.6.0
  • Essential Addons for Elementor 4.6.1
  • Essential Addons for Elementor 4.6.2
  • Essential Addons for Elementor 4.6.3
  • Essential Addons for Elementor 4.6.4

Privilege Escalation in Essential Addons for Elementor Login Register Form

Users who can edit pages with Elementor, such as contributors, can add a Login/Register form whose new-user role is set to Administrator, then register through it and get an administrator account. Essential Addons for Elementor 4.6.4 and older are affected.

This vulnerability affects the following application versions:

  • Essential Addons for Elementor 4.2.3
  • Essential Addons for Elementor 4.2.4
  • Essential Addons for Elementor 4.3.0
  • Essential Addons for Elementor 4.3.1
  • Essential Addons for Elementor 4.3.2
  • Essential Addons for Elementor 4.3.3
  • Essential Addons for Elementor 4.3.4
  • Essential Addons for Elementor 4.3.5
  • Essential Addons for Elementor 4.3.6
  • Essential Addons for Elementor 4.3.7
  • Essential Addons for Elementor 4.3.8
  • Essential Addons for Elementor 4.3.9
  • Essential Addons for Elementor 4.4.0
  • Essential Addons for Elementor 4.4.1
  • Essential Addons for Elementor 4.5.0
  • Essential Addons for Elementor 4.5.1
  • Essential Addons for Elementor 4.5.2
  • Essential Addons for Elementor 4.5.3
  • Essential Addons for Elementor 4.5.4
  • Essential Addons for Elementor 4.5.5
  • Essential Addons for Elementor 4.6.0
  • Essential Addons for Elementor 4.6.1
  • Essential Addons for Elementor 4.6.2
  • Essential Addons for Elementor 4.6.3
  • Essential Addons for Elementor 4.6.4

Stored Cross-Site Scripting in Essential Addons for Elementor Advanced Tabs

The Advanced Tabs widget rendered repeater tab titles through a custom HTML allowlist that permitted