GCVE - cpe:2.3:a:bdthemes:element_pack:*:*:*:*:pro:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bdthemes:element_pack:*:*:*:*:pro:wordpress:*:*

part: a version: * update: *

Vendor	Bdthemes (`5429b37a-0acd-5ad1-805d-fa178e11cdda`)
Product	Element Pack (`387b1c9e-bd6d-57cd-8611-1ec1f443c573`)
Edition	*
Language	*
Software edition	pro
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-33568`	vulnerable	2026-06-03 14:55:52.574812	WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability HIGH (8.5) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3. Published: 2024-06-04T13:12:10.673Z Updated: 2026-04-28T16:09:43.384Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/bdthemes-element-pack/wordpress-element-pack-pro-plugin-7-7-4-arbitrary-file-read-and-phar-deserialization-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2455`	vulnerable	2026-06-03 14:55:29.290183	Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL MEDIUM (6.4) The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-08-01T12:43:26.820Z Updated: 2026-04-08T16:37:44.962Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/1903527e-d7d9-48a0-b59d-65ec5e14def2?source=cve https://feedback.elementpack.pro/announcements#:~:text=Version%207.9.1%20Released https://feedback.elementpack.pro/announcements	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-0837`	vulnerable	2026-06-03 14:54:04.296858	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget MEDIUM (6.4) The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-04-06T07:34:55.697Z Updated: 2026-04-08T17:13:14.698Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/a54c2a89-4297-48f5-bbff-e5c20c26a632?source=cve https://plugins.trac.wordpress.org/changeset/3045497/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.