Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,235

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,499

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-49387	critical	10.0/10	WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability	Aug 28, 2025 11mo ago
CVE-2025-48354	medium	6.5/10	WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 11mo ago
CVE-2025-8603	medium	6.4/10	Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting	Aug 28, 2025 11mo ago
CVE-2025-58208	medium	6.5/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin <= 6.2.0 - Cross Site Scripting (XSS) Vulnerability	Aug 27, 2025 11mo ago
CVE-2025-58205	medium	6.5/10	WordPress ElementInvader Addons for Elementor Plugin <= 1.3.6 - Cross Site Scripting (XSS) Vulnerability	Aug 27, 2025 11mo ago
CVE-2025-58195	medium	6.5/10	WordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) Vulnerability	Aug 27, 2025 11mo ago
CVE-2025-8208	medium	6.4/10	Spexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Aug 24, 2025 11mo ago
CVE-2025-53983	medium	6.5/10	WordPress JetElements For Elementor <= 2.7.7 - Sensitive Data Exposure Vulnerability	Aug 20, 2025 11mo ago
CVE-2025-53988	medium	6.5/10	WordPress JetBlocks For Elementor <= 1.3.18 - Sensitive Data Exposure Vulnerability	Aug 20, 2025 11mo ago
CVE-2025-7439	medium	6.4/10	Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link	Aug 16, 2025 11mo ago
CVE-2025-7440	medium	6.4/10	Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link	Aug 16, 2025 11mo ago
CVE-2025-8451	medium	6.4/10	Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'	Aug 15, 2025 11mo ago
CVE-2025-8867	medium	6.4/10	Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Aug 15, 2025 11mo ago
CVE-2025-54712	medium	4.3/10	WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-55712	medium	6.5/10	WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 6.3.13 - Broken Access Control Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-55714	medium	6.5/10	WordPress JetElements For Elementor Plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability	Aug 14, 2025 11mo ago
CVE-2024-37945	medium	6.5/10	WordPress WPBITS Addons For Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability	Aug 14, 2025 11mo ago
CVE-2025-54704	medium	6.5/10	WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-7384	critical	9.8/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion	Aug 13, 2025 12mo ago
CVE-2025-8874	medium	6.4/10	Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox	Aug 12, 2025 12mo ago
CVE-2025-8081	medium	4.9/10	Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import	Aug 12, 2025 12mo ago
CVE-2025-7498	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown	Aug 6, 2025 1y ago
CVE-2025-8100	medium	5.4/10	Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content	Aug 6, 2025 1y ago
CVE-2025-8488	medium	4.3/10	Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update	Aug 2, 2025 1y ago
CVE-2025-8212	medium	6.4/10	Medical Addon for Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget	Aug 2, 2025 1y ago
CVE-2025-8146	medium	6.4/10	Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget	Aug 2, 2025 1y ago
CVE-2025-6228	medium	6.4/10	Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets	Aug 1, 2025 1y ago
CVE-2025-7646	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	Aug 1, 2025 1y ago
CVE-2025-7845	medium	6.4/10	Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets	Aug 1, 2025 1y ago
CVE-2025-8068	medium	4.3/10	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions	Jul 31, 2025 1y ago