Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,730

All time

Critical · Active

10,857

CVSS ≥ 9.0

New · 14 days

2,602

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-8488	medium	4.3/10	Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update	Aug 2, 2025 11mo ago
CVE-2025-8212	medium	6.4/10	Medical Addon for Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget	Aug 2, 2025 11mo ago
CVE-2025-8146	medium	6.4/10	Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget	Aug 2, 2025 11mo ago
CVE-2025-6228	medium	6.4/10	Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets	Aug 1, 2025 11mo ago
CVE-2025-7646	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	Aug 1, 2025 11mo ago
CVE-2025-7845	medium	6.4/10	Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets	Aug 1, 2025 11mo ago
CVE-2025-8068	medium	4.3/10	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions	Jul 31, 2025 11mo ago
CVE-2025-8401	medium	4.3/10	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure	Jul 31, 2025 11mo ago
CVE-2025-8151	medium	4.3/10	HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions	Jul 31, 2025 11mo ago
CVE-2025-8196	medium	6.4/10	Magical Addons For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes	Jul 29, 2025 11mo ago
CVE-2025-8216	medium	6.4/10	Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jul 29, 2025 11mo ago
CVE-2025-4566	medium	6.4/10	Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget	Jul 29, 2025 11mo ago
CVE-2025-3075	medium	6.4/10	Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jul 29, 2025 11mo ago
CVE-2025-3614	medium	6.4/10	ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget	Jul 24, 2025 11mo ago
CVE-2025-7644	medium	6.4/10	Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jul 22, 2025 12mo ago
CVE-2025-7697	critical	9.8/10	Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function	Jul 19, 2025 12mo ago
CVE-2025-7696	critical	9.8/10	Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function	Jul 19, 2025 12mo ago
CVE-2025-48295	medium	6.5/10	WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-54050	medium	6.5/10	WordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-54037	medium	5.4/10	WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability	Jul 16, 2025 1y ago
CVE-2025-54033	medium	6.5/10	WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-53989	medium	6.5/10	WordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-53982	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-5284	medium	6.4/10	Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jul 16, 2025 1y ago
CVE-2025-7340	critical	9.8/10	HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload	Jul 15, 2025 1y ago
CVE-2025-7360	critical	9.1/10	HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move	Jul 15, 2025 1y ago
CVE-2025-7341	critical	9.1/10	HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion	Jul 15, 2025 1y ago
CVE-2025-6244	medium	6.4/10	Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets	Jul 8, 2025 1y ago
CVE-2024-11937	medium	6.4/10	Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jul 4, 2025 1y ago
CVE-2025-7046	medium	6.4/10	Portfolio for Elementor & Image Gallery \| PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS	Jul 4, 2025 1y ago