Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,613

All time

Critical · Active

10,844

CVSS ≥ 9.0

New · 14 days

2,602

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

elementor security

Every published CVE affecting elementor

This list contains every CVE that names elementor as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of elementor are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-13402	—	—	Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure	Jul 17, 2026 today
CVE-2026-61976	medium	5.3/10	WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability	Jul 13, 2026 4d ago
CVE-2026-57804	high	7.5/10	WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability	Jul 13, 2026 4d ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57376	high	7.1/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-15338	high	7.5/10	LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting	Jul 11, 2026 6d ago
CVE-2026-13710	medium	6.4/10	Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget	Jul 10, 2026 7d ago
CVE-2026-15299	medium	6.4/10	Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget	Jul 10, 2026 7d ago
CVE-2026-15285	medium	6.4/10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	Jul 10, 2026 7d ago
CVE-2026-15284	medium	6.4/10	King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter	Jul 10, 2026 7d ago
CVE-2026-10570	medium	6.4/10	Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values	Jul 8, 2026 9d ago
CVE-2026-11328	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	Jul 7, 2026 10d ago
CVE-2026-59511	medium	5.3/10	WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability	Jul 5, 2026 11d ago
CVE-2026-9145	medium	6.5/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'	Jul 2, 2026 15d ago
CVE-2026-11600	medium	4.3/10	Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting	Jul 2, 2026 15d ago
CVE-2026-11380	medium	6.4/10	JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting	Jul 1, 2026 16d ago
CVE-2026-49765	critical	9.8/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49109	critical	9.8/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49105	critical	9.8/10	WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49104	critical	9.8/10	WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49085	critical	9.8/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-48870	medium	6.5/10	WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-45437	high	7.1/10	WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-25440	medium	5.3/10	WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability	Jun 15, 2026 1mo ago
CVE-2026-9691	critical	9.8/10	WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2023-25969	medium	5.4/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability	Jun 11, 2026 1mo ago
CVE-2026-8613	medium	6.4/10	aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting	Jun 10, 2026 1mo ago
CVE-2025-8444	medium	6.4/10	Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters	Jun 10, 2026 1mo ago
CVE-2026-8677	medium	6.4/10	Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings	Jun 9, 2026 1mo ago
CVE-2026-11603	medium	6.1/10	Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter	Jun 9, 2026 1mo ago