Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,731

All time

Critical · Active

10,857

CVSS ≥ 9.0

New · 14 days

2,599

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 361–390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-5944	medium	6.4/10	Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute	Jul 3, 2025 1y ago
CVE-2025-2330	medium	6.4/10	All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget	Jul 2, 2025 1y ago
CVE-2025-6686	medium	6.4/10	Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode	Jul 2, 2025 1y ago
CVE-2025-6687	medium	6.4/10	Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode	Jul 2, 2025 1y ago
CVE-2025-46259	medium	5.4/10	WordPress The Plus Addons for Elementor - Pro Plugin < 6.3.7 - Broken Access Control vulnerability	Jul 1, 2025 1y ago
CVE-2025-6252	medium	6.4/10	Qi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 28, 2025 1y ago
CVE-2025-53339	high	7.5/10	WordPress Devnex Addons For Elementor plugin <= 1.0.9 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-53199	medium	6.5/10	WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-6550	medium	6.4/10	The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2025 1y ago
CVE-2025-5338	medium	6.4/10	Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets	Jun 26, 2025 1y ago
CVE-2025-3863	medium	4.3/10	Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function	Jun 26, 2025 1y ago
CVE-2025-50038	medium	6.5/10	WordPress Anant Addons for Elementor plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability	Jun 20, 2025 1y ago
CVE-2025-30562	high	8.5/10	WordPress Navigation Tree Elementor plugin <= 1.0.1 - SQL Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-49444	critical	10.0/10	WordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerability	Jun 17, 2025 1y ago
CVE-2025-5938	medium	5.3/10	Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import	Jun 13, 2025 1y ago
CVE-2025-4774	medium	6.4/10	Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jun 10, 2025 1y ago
CVE-2025-3076	medium	6.4/10	Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 10, 2025 1y ago
CVE-2025-30948	medium	4.3/10	WordPress Layouts for Elementor plugin <= 1.11 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49262	high	7.6/10	WordPress Sina Extension for Elementor plugin <= 3.6.1 - Cross Site Scripting (XSS) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49235	medium	6.5/10	WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability	Jun 6, 2025 1y ago
CVE-2025-49076	medium	6.5/10	WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.2.7 - Cross Site Scripting (XSS) vulnerability	Jun 6, 2025 1y ago
CVE-2025-5340	medium	6.4/10	Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter	Jun 3, 2025 1y ago
CVE-2025-3813	medium	6.4/10	Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 31, 2025 1y ago
CVE-2025-5290	medium	6.4/10	Borderless – Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 31, 2025 1y ago
CVE-2025-5292	medium	6.4/10	Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 31, 2025 1y ago
CVE-2025-4944	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets	May 30, 2025 1y ago
CVE-2025-4943	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter	May 30, 2025 1y ago
CVE-2025-4659	medium	5.3/10	Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure	May 30, 2025 1y ago
CVE-2025-4783	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget	May 26, 2025 1y ago
CVE-2025-31636	high	7.1/10	WordPress WP Post Modules for Elementor plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability	May 23, 2025 1y ago