# cve.now: Bdthemes

The newest entries naming Bdthemes as an affected vendor (up to 200), of 105 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119501](https://cve.now/CVE-2026-119501.md): WordPress Element Pack Elementor Addons plugin \<= 10.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-119502](https://cve.now/CVE-2026-119502.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 4.0.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-111111](https://cve.now/CVE-2026-111111.md): Prime Slider \<= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content\_Guard Regex Quote-Escape (CVSS 7.2)
- [CVE-2026-109691](https://cve.now/CVE-2026-109691.md): WordPress Prime Slider – Addons For Elementor plugin \<= 4.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-108478](https://cve.now/CVE-2026-108478.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-105886](https://cve.now/CVE-2026-105886.md): WordPress Ultimate Post Kit plugin \<= 4.5.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-105875](https://cve.now/CVE-2026-105875.md): WordPress Prime Slider – Addons For Elementor plugin \<= 4.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-105873](https://cve.now/CVE-2026-105873.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-105871](https://cve.now/CVE-2026-105871.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-93527](https://cve.now/CVE-2026-93527.md): WordPress Live Copy Paste for Elementor plugin \<= 1.5.10 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-92991](https://cve.now/CVE-2026-92991.md): Biggopti Library (Various Versions) - Cross-Site Scripting via display\_id from Sigmative API (CVSS 5.4)
- [CVE-2026-66574](https://cve.now/CVE-2026-66574.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-78657](https://cve.now/CVE-2026-78657.md): SigmaForms Pro \<= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field (CVSS 9.8)
- [CVE-2026-14494](https://cve.now/CVE-2026-14494.md): Sigma Forms Pro \<= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field (CVSS 9.8)
- [CVE-2026-65502](https://cve.now/CVE-2026-65502.md): WordPress Element Pack Elementor Addons plugin \<= 8.7.13 - Captcha Bypass vulnerability (CVSS 5.3)
- [CVE-2026-25403](https://cve.now/CVE-2026-25403.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 3.0.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-0673](https://cve.now/CVE-2026-0673.md): Element Pack Addons for Elementor \<= 8.3.15 - Unauthenticated SMTP Header Injection (CVSS 5.3)
- [CVE-2026-65505](https://cve.now/CVE-2026-65505.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 3.0.5 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-65503](https://cve.now/CVE-2026-65503.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57413](https://cve.now/CVE-2026-57413.md): WordPress Instant Image Generator plugin \<= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4)
- [CVE-2025-63079](https://cve.now/CVE-2025-63079.md): WordPress Live Copy Paste for Elementor plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-52705](https://cve.now/CVE-2026-52705.md): WordPress SigmaForms Pro – AI Generated Forms plugin \<= 1.4.5 - Arbitrary File Upload vulnerability (CVSS 9.0)
- [CVE-2026-40721](https://cve.now/CVE-2026-40721.md): WordPress Element Pack Pro plugin \<= 9.0.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-40745](https://cve.now/CVE-2026-40745.md): WordPress Element Pack Elementor Addons plugin \<= 8.4.2 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-4655](https://cve.now/CVE-2026-4655.md): Element Pack Addons for Elementor \<= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget (CVSS 6.4)
- [CVE-2026-4341](https://cve.now/CVE-2026-4341.md): Prime Slider \<= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow\_us\_text' Parameter (CVSS 6.4)
- [CVE-2026-24362](https://cve.now/CVE-2026-24362.md): WordPress Ultimate Post Kit plugin \<= 4.0.21 - Broken Access Control vulnerability (CVSS 6.4)
- [CVE-2026-1793](https://cve.now/CVE-2026-1793.md): Element Pack Addons for Elementor \<= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5)
- [CVE-2025-31413](https://cve.now/CVE-2025-31413.md): WordPress Element Pack Elementor Addons plugin \<= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-0808](https://cve.now/CVE-2026-0808.md): Spin Wheel \<= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize\_index' Parameter (CVSS 5.3)
- [CVE-2025-69336](https://cve.now/CVE-2025-69336.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.9.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-68500](https://cve.now/CVE-2025-68500.md): WordPress Prime Slider – Addons For Elementor plugin \<= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- [CVE-2025-14277](https://cve.now/CVE-2025-14277.md): Prime Slider – Addons for Elementor \<= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 4.3)
- [CVE-2025-13196](https://cve.now/CVE-2025-13196.md): Element Pack Addons for Elementor \<= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget (CVSS 5.4)
- [CVE-2025-12134](https://cve.now/CVE-2025-12134.md): ZoloBlocks \<= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable (CVSS 5.3)
- [CVE-2025-49903](https://cve.now/CVE-2025-49903.md): WordPress ZoloBlocks plugin \<= 2.3.11 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-11536](https://cve.now/CVE-2025-11536.md): Element Pack Addons for Elementor \<= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery (CVSS 5.0)
- [CVE-2025-9075](https://cve.now/CVE-2025-9075.md): ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns \<= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-60161](https://cve.now/CVE-2025-60161.md): WordPress ZoloBlocks Plugin \<= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4)
- [CVE-2025-58017](https://cve.now/CVE-2025-58017.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-58230](https://cve.now/CVE-2025-58230.md): WordPress ZoloBlocks plugin \<= 2.3.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-53210](https://cve.now/CVE-2025-53210.md): WordPress ZoloBlocks Plugin \<= 2.3.2 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-8100](https://cve.now/CVE-2025-8100.md): Element Pack Elementor Addons and Templates \<= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content (CVSS 5.4)
- [CVE-2025-7644](https://cve.now/CVE-2025-7644.md): Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery \<= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-5944](https://cve.now/CVE-2025-5944.md): Element Pack Addons for Elementor \<= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute (CVSS 6.4)
- [CVE-2025-46258](https://cve.now/CVE-2025-46258.md): WordPress Element Pack Pro Plugin \< 8.0.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-46257](https://cve.now/CVE-2025-46257.md): WordPress Element Pack Pro Plugin \< 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-5292](https://cve.now/CVE-2025-5292.md): Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder \<= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-2168](https://cve.now/CVE-2025-2168.md): Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \<= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update (CVSS 4.3)
- [CVE-2025-1458](https://cve.now/CVE-2025-1458.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \<= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-1457](https://cve.now/CVE-2025-1457.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \<= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-39588](https://cve.now/CVE-2025-39588.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.4.0 - Deserialization of untrusted data Vulnerability (CVSS 9.8)
- [CVE-2025-32184](https://cve.now/CVE-2025-32184.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-24584](https://cve.now/CVE-2025-24584.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.3.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-12043](https://cve.now/CVE-2024-12043.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12851](https://cve.now/CVE-2024-12851.md): Element Pack Lite - Addons for Elementor \<= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-11852](https://cve.now/CVE-2024-11852.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.12 - Missing Authorization (CVSS 4.3)
- [CVE-2024-9058](https://cve.now/CVE-2024-9058.md): Element Pack Elementor Addons \<= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget (CVSS 6.4)
- [CVE-2024-52377](https://cve.now/CVE-2024-52377.md): WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin \<= 1.5.2 - Arbitrary File Upload vulnerability (CVSS 10.0)
- [CVE-2024-8442](https://cve.now/CVE-2024-8442.md): Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider \<= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget (CVSS 6.4)
- [CVE-2024-9867](https://cve.now/CVE-2024-9867.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget (CVSS 5.4)
- [CVE-2024-9657](https://cve.now/CVE-2024-9657.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.5)
- [CVE-2024-9868](https://cve.now/CVE-2024-9868.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate (CVSS 5.4)
- [CVE-2024-10310](https://cve.now/CVE-2024-10310.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget (CVSS 6.4)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-47392](https://cve.now/CVE-2024-47392.md): WordPress Element Pack Elementor Addons plugin \<= 5.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-47629](https://cve.now/CVE-2024-47629.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-8030](https://cve.now/CVE-2024-8030.md): Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \<= 2.0.3 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-5335](https://cve.now/CVE-2024-5335.md): Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \<= 1.6.4 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-43342](https://cve.now/CVE-2024-43342.md): WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-7247](https://cve.now/CVE-2024-7247.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets (CVSS 6.4)
- [CVE-2024-4359](https://cve.now/CVE-2024-4359.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5)
- [CVE-2024-4360](https://cve.now/CVE-2024-4360.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title\_tag (CVSS 6.4)
- [CVE-2024-4643](https://cve.now/CVE-2024-4643.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-39667](https://cve.now/CVE-2024-39667.md): WordPress Element Pack Elementor Addons plugin \<= 5.6.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-2455](https://cve.now/CVE-2024-2455.md): Element Pack - Addon for Elementor Page Builder WordPress Plugin \<= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL (CVSS 6.4)
- [CVE-2024-5555](https://cve.now/CVE-2024-5555.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5554](https://cve.now/CVE-2024-5554.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5662](https://cve.now/CVE-2024-5662.md): Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) \<= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget (CVSS 6.4)
- [CVE-2024-3925](https://cve.now/CVE-2024-3925.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events (CVSS 6.4)
- [CVE-2024-5640](https://cve.now/CVE-2024-5640.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget (CVSS 6.4)
- [CVE-2024-33568](https://cve.now/CVE-2024-33568.md): WordPress Element Pack Pro plugin \< 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability (CVSS 8.5)
- [CVE-2024-3997](https://cve.now/CVE-2024-3997.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget (CVSS 6.4)
- [CVE-2024-3926](https://cve.now/CVE-2024-3926.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom\_attributes (CVSS 6.4)
- [CVE-2024-3927](https://cve.now/CVE-2024-3927.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.3 - Form Submission Admin Email Bypass (CVSS 5.3)
- [CVE-2024-4339](https://cve.now/CVE-2024-4339.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4606](https://cve.now/CVE-2024-4606.md): WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin \<= 2.0.3 - PHP Object Injection vulnerability (CVSS 5.4)
- [CVE-2024-32681](https://cve.now/CVE-2024-32681.md): WordPress Prime Slider plugin \<= 3.13.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-32682](https://cve.now/CVE-2024-32682.md): WordPress Prime Slider plugin \<= 3.13.2 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2024-1730](https://cve.now/CVE-2024-1730.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) \<= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-32572](https://cve.now/CVE-2024-32572.md): WordPress Element Pack Elementor Addons plugin \<= 5.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-1429](https://cve.now/CVE-2024-1429.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget (CVSS 6.4)
- [CVE-2024-1426](https://cve.now/CVE-2024-1426.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget (CVSS 6.4)
- [CVE-2024-2966](https://cve.now/CVE-2024-2966.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.5.6 - Sensitive Information Exposure via element\_pack\_ajax\_search (CVSS 5.3)
- [CVE-2024-31357](https://cve.now/CVE-2024-31357.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-0837](https://cve.now/CVE-2024-0837.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget (CVSS 6.4)
- [CVE-2024-1428](https://cve.now/CVE-2024-1428.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget (CVSS 6.4)
- [CVE-2024-30496](https://cve.now/CVE-2024-30496.md): WordPress Element Pack Lite plugin \<= 5.5.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-30186](https://cve.now/CVE-2024-30186.md): WordPress Prime Slider plugin \<= 3.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-30185](https://cve.now/CVE-2024-30185.md): WordPress Element Pack Elementor Addons plugin \<= 5.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-24840](https://cve.now/CVE-2024-24840.md): WordPress Element Pack Elementor Addons plugin \<= 5.4.11 - Broken Access Control on Duplicate Post vulnerability (CVSS 4.3)
- [CVE-2024-24883](https://cve.now/CVE-2024-24883.md): WordPress Prime Slider plugin \<= 3.11.10 - Broken Access Control on Duplicate Post vulnerability (CVSS 4.3)
- [CVE-2024-1508](https://cve.now/CVE-2024-1508.md): Prime Slider – Addons For Elementor \<= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget (CVSS 6.4)
- [CVE-2024-1507](https://cve.now/CVE-2024-1507.md): Prime Slider – Addons For Elementor \<= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget (CVSS 6.4)
- [CVE-2024-1506](https://cve.now/CVE-2024-1506.md): Prime Slider – Addons For Elementor \<= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bdthemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.