Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

elementor security

Every published CVE affecting elementor

This list contains every CVE that names elementor as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of elementor are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-81777	medium	5.3/10	WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability	Aug 28, 2026 2d ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 6d ago
CVE-2026-13405	—	—	Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder	Aug 20, 2026 10d ago
CVE-2026-74003	medium	4.3/10	WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability	Aug 18, 2026 12d ago
CVE-2026-28192	critical	9.6/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability	Aug 18, 2026 12d ago
CVE-2026-18039	—	—	Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment	Aug 14, 2026 16d ago
CVE-2026-66688	medium	6.5/10	WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 24d ago
CVE-2026-65549	high	7.2/10	WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability	Aug 6, 2026 24d ago
CVE-2026-65502	medium	5.3/10	WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability	Aug 6, 2026 24d ago
CVE-2026-28146	medium	6.5/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability	Aug 6, 2026 24d ago
CVE-2026-25403	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability	Aug 6, 2026 24d ago
CVE-2026-14872	—	—	Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter	Aug 4, 2026 26d ago
CVE-2026-28147	medium	5.4/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability	Aug 3, 2026 27d ago
CVE-2026-12231	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'	Aug 2, 2026 28d ago
CVE-2026-14817	—	—	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Aug 2, 2026 28d ago
CVE-2026-14841	—	—	King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget	Aug 2, 2026 28d ago
CVE-2026-2916	medium	4.3/10	Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script	Aug 1, 2026 29d ago
CVE-2026-1982	medium	5.3/10	Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget	Jul 30, 2026 1mo ago
CVE-2026-14870	—	—	Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id	Jul 28, 2026 1mo ago
CVE-2026-65534	medium	5.9/10	WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65505	medium	5.3/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65503	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65489	medium	5.3/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65488	high	7.1/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65482	medium	6.5/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65465	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-15787	medium	6.4/10	Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes	Jul 22, 2026 1mo ago
CVE-2026-8825	—	—	Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API	Jul 20, 2026 1mo ago
CVE-2026-10081	—	—	Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget	Jul 20, 2026 1mo ago
CVE-2026-13402	—	—	Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure	Jul 17, 2026 1mo ago