Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,425

All time

Critical · Active

12,667

CVSS ≥ 9.0

New · 14 days

1,947

Newly disclosed

Feed last synced

1 hr ago

Data freshness

elementor security

Every published CVE affecting elementor

This list contains every CVE that names elementor as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of elementor are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-94662	high	7.1/10	WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability	Oct 7, 2026 7d ago
CVE-2026-103355	critical	9.3/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability	Oct 4, 2026 10d ago
CVE-2026-103344	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Oct 4, 2026 10d ago
CVE-2026-103342	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Oct 3, 2026 11d ago
CVE-2026-75028	high	7.5/10	WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting	Oct 3, 2026 11d ago
CVE-2026-92923	—	—	Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data	Oct 3, 2026 11d ago
CVE-2026-85568	—	—	Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter	Oct 3, 2026 11d ago
CVE-2026-85015	—	—	Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal	Oct 3, 2026 11d ago
CVE-2025-12828	medium	6.4/10	Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget	Oct 3, 2026 11d ago
CVE-2026-100180	medium	5.4/10	Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment	Oct 3, 2026 12d ago
CVE-2026-103064	medium	6.5/10	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2026 13d ago
CVE-2026-103341	medium	5.3/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability	Oct 1, 2026 13d ago
CVE-2026-11895	medium	6.4/10	HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting	Sep 30, 2026 14d ago
CVE-2026-94573	high	7.2/10	Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value	Sep 25, 2026 19d ago
CVE-2026-85017	—	—	Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection	Sep 20, 2026 24d ago
CVE-2026-8354	medium	6.4/10	Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting	Sep 19, 2026 25d ago
CVE-2026-1641	medium	6.5/10	Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting	Sep 19, 2026 25d ago
CVE-2026-17585	medium	5.3/10	Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter	Sep 12, 2026 1mo ago
CVE-2026-18351	critical	9.8/10	Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter	Sep 10, 2026 1mo ago
CVE-2026-75586	medium	6.1/10	Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter	Sep 5, 2026 1mo ago
CVE-2026-81777	medium	5.3/10	WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability	Aug 28, 2026 1mo ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 1mo ago
CVE-2026-13405	—	—	Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder	Aug 20, 2026 1mo ago
CVE-2026-74003	medium	4.3/10	WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability	Aug 18, 2026 1mo ago
CVE-2026-28192	critical	9.6/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability	Aug 18, 2026 1mo ago
CVE-2026-18039	—	—	Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment	Aug 14, 2026 2mo ago
CVE-2026-66688	medium	6.5/10	WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65549	high	7.2/10	WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability	Aug 6, 2026 2mo ago
CVE-2026-65502	medium	5.3/10	WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability	Aug 6, 2026 2mo ago
CVE-2026-28146	medium	6.5/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability	Aug 6, 2026 2mo ago