CVE-2024-9889 ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure

What is CVE-2024-9889?

CVE-2024-9889 is a medium-severity vulnerability in ElementInvader Addons for Elementor, published on 19 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via the Page Loader widget. This makes it possible for authenticated attackers, with contributor-level access and above, to view private/draft/password protected posts, pages, and Elementor templates that they should not have access to.

Weakness: CWE-200

Which versions are affected by CVE-2024-9889?

It affects 1 product.

Products include Elementinvader Elementinvader Addons for Elementor.

How do I fix CVE-2024-9889?

No fix has been published for CVE-2024-9889 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-9889 being exploited?

There is no known exploitation of CVE-2024-9889 in the wild and no public exploit code.

Other vulnerabilities in ElementInvader Addons for Elementor

• CVE-2025-22786 WordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerability High 7.5
• CVE-2025-24578 WordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2025-24729 WordPress ElementInvader Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-47630 WordPress ElementInvader Addons for Elementor plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-38705 WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mwgg-h6w2-q9c9.