Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,230

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,629

Newly disclosed

Feed last synced

40 mins ago

Data freshness

elementor security

Every published CVE affecting elementor

This list contains every CVE that names elementor as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of elementor are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66688	medium	6.5/10	WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 yesterday
CVE-2026-65549	high	7.2/10	WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability	Aug 6, 2026 yesterday
CVE-2026-65502	medium	5.3/10	WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability	Aug 6, 2026 yesterday
CVE-2026-28146	medium	6.5/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability	Aug 6, 2026 yesterday
CVE-2026-25403	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability	Aug 6, 2026 yesterday
CVE-2026-14872	—	—	Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter	Aug 4, 2026 4d ago
CVE-2026-28147	medium	5.4/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability	Aug 3, 2026 5d ago
CVE-2026-12231	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'	Aug 2, 2026 5d ago
CVE-2026-14817	—	—	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Aug 2, 2026 6d ago
CVE-2026-14841	—	—	King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget	Aug 2, 2026 6d ago
CVE-2026-2916	medium	4.3/10	Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script	Aug 1, 2026 7d ago
CVE-2026-1982	medium	5.3/10	Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget	Jul 30, 2026 9d ago
CVE-2026-14870	—	—	Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id	Jul 28, 2026 11d ago
CVE-2026-65534	medium	5.9/10	WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 15d ago
CVE-2026-65505	medium	5.3/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability	Jul 23, 2026 15d ago
CVE-2026-65503	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 15d ago
CVE-2026-65489	medium	5.3/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability	Jul 23, 2026 15d ago
CVE-2026-65488	high	7.1/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Jul 23, 2026 15d ago
CVE-2026-65482	medium	6.5/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 15d ago
CVE-2026-65465	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 15d ago
CVE-2026-15787	medium	6.4/10	Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes	Jul 22, 2026 16d ago
CVE-2026-8825	—	—	Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API	Jul 20, 2026 19d ago
CVE-2026-10081	—	—	Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget	Jul 20, 2026 19d ago
CVE-2026-13402	—	—	Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure	Jul 17, 2026 22d ago
CVE-2026-61976	medium	5.3/10	WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability	Jul 13, 2026 25d ago
CVE-2026-57804	high	7.5/10	WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability	Jul 13, 2026 25d ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-57376	high	7.1/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 25d ago
CVE-2026-15338	high	7.5/10	LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting	Jul 11, 2026 28d ago
CVE-2026-13710	medium	6.4/10	Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget	Jul 10, 2026 28d ago