# cve.now: Nicheaddons

The newest entries naming Nicheaddons as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2025-8150](https://cve.now/CVE-2025-8150.md): Events Addon for Elementor \<= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets (CVSS 6.4)
- [CVE-2025-8212](https://cve.now/CVE-2025-8212.md): Medical Addon for Elementor \<= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget (CVSS 6.4)
- [CVE-2024-13854](https://cve.now/CVE-2024-13854.md): Education Addon for Elementor \<= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu\_elementor\_template Shortcode (CVSS 4.3)
- [CVE-2024-12046](https://cve.now/CVE-2024-12046.md): Medical Addon for Elementor \<= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode (CVSS 4.3)
- [CVE-2024-12061](https://cve.now/CVE-2024-12061.md): Events Addon for Elementor \<= 2.2.3 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-54316](https://cve.now/CVE-2024-54316.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-54315](https://cve.now/CVE-2024-54315.md): WordPress Events Addon for Elementor plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-54314](https://cve.now/CVE-2024-54314.md): WordPress Primary Addon for Elementor plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-47826](https://cve.now/CVE-2023-47826.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-12062](https://cve.now/CVE-2024-12062.md): Charity Addon for Elementor \<= 1.3.3 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-10780](https://cve.now/CVE-2024-10780.md): Restaurant & Cafe Addon for Elementor \<= 1.5.9 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-10670](https://cve.now/CVE-2024-10670.md): Primary Addon for Elementor \<= 1.6.2 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-51938](https://cve.now/CVE-2024-51938.md): WordPress Charity Addon for Elementor plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-51581](https://cve.now/CVE-2024-51581.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-51585](https://cve.now/CVE-2024-51585.md): WordPress Sales Page Addon plugin \<= 1.4.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-49259](https://cve.now/CVE-2024-49259.md): WordPress Primary Addon for Elementor plugin \<= 1.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-49264](https://cve.now/CVE-2024-49264.md): WordPress Events Addon for Elementor plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-44024](https://cve.now/CVE-2024-44024.md): WordPress Medical Addon for Elementor plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-44026](https://cve.now/CVE-2024-44026.md): WordPress Charity Addon for Elementor plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-44032](https://cve.now/CVE-2024-44032.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-44033](https://cve.now/CVE-2024-44033.md): WordPress Primary Addon for Elementor plugin \<= 1.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4669](https://cve.now/CVE-2024-4669.md): Events Addon for Elementor \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-5229](https://cve.now/CVE-2024-5229.md): Primary Addon for Elementor \<= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4)
- [CVE-2023-47827](https://cve.now/CVE-2023-47827.md): WordPress Events Addon for Elementor Plugin \<= 2.1.3 is vulnerable to Broken Access Control (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nicheaddons
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.