Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,720

All time

Critical · Active

10,855

CVSS ≥ 9.0

New · 14 days

2,599

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 271–300 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-9698	—	—	The Plus Addons for Elementor < 6.3.16 - Author+ Stored XSS	Oct 13, 2025 9mo ago
CVE-2025-9703	—	—	Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS	Oct 6, 2025 9mo ago
CVE-2025-9029	medium	4.3/10	WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function	Oct 4, 2025 9mo ago
CVE-2025-9204	medium	6.4/10	X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field	Oct 3, 2025 9mo ago
CVE-2025-9077	medium	6.4/10	Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field	Oct 3, 2025 9mo ago
CVE-2025-9045	medium	6.4/10	Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	Oct 3, 2025 9mo ago
CVE-2025-8608	medium	6.4/10	Mihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins	Sep 30, 2025 9mo ago
CVE-2025-8214	medium	6.4/10	The Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget	Sep 30, 2025 9mo ago
CVE-2025-60167	medium	4.3/10	WordPress Page Manager for Elementor Plugin <= 2.0.5 - Sensitive Data Exposure Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60112	medium	6.5/10	WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-60096	medium	5.4/10	WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control Vulnerability	Sep 26, 2025 9mo ago
CVE-2025-10173	low	2.7/10	ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update	Sep 26, 2025 9mo ago
CVE-2025-8200	medium	6.4/10	Mega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget	Sep 26, 2025 9mo ago
CVE-2025-58973	high	7.5/10	WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-59553	medium	6.5/10	WordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-59592	medium	6.5/10	WordPress Make Column Clickable Elementor Plugin <= 1.6.0 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-57939	medium	5.3/10	WordPress Image Hover Effects – Elementor Addon Plugin <= 1.4.4 - Broken Access Control Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-57955	medium	6.5/10	WordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-57995	medium	4.3/10	WordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-57999	medium	6.5/10	WordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58017	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58251	medium	4.3/10	WordPress Sticky Header Effects for Elementor Plugin <= 2.1.2 - Broken Access Control Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-58254	medium	6.5/10	WordPress StylePress for Elementor Plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability	Sep 22, 2025 9mo ago
CVE-2025-9203	medium	6.4/10	Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields	Sep 17, 2025 10mo ago
CVE-2025-8215	medium	6.4/10	Responsive Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Sep 11, 2025 10mo ago
CVE-2025-8481	medium	4.3/10	Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery	Sep 11, 2025 10mo ago
CVE-2025-8445	medium	6.4/10	Countdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'	Sep 11, 2025 10mo ago
CVE-2025-8388	medium	6.4/10	PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'	Sep 10, 2025 10mo ago
CVE-2025-8564	medium	6.4/10	SKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Sep 6, 2025 10mo ago
CVE-2025-8149	medium	6.4/10	aThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Sep 6, 2025 10mo ago