Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,732

All time

Critical · Active

10,857

CVSS ≥ 9.0

New · 14 days

2,595

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 391–420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-47492	high	8.6/10	WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.4.3 - Arbitrary File Deletion Vulnerability	May 23, 2025 1y ago
CVE-2025-39447	high	7.5/10	WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability	May 19, 2025 1y ago
CVE-2025-39451	high	7.5/10	WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability	May 19, 2025 1y ago
CVE-2025-39448	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability	May 19, 2025 1y ago
CVE-2025-48288	medium	6.5/10	WordPress ElementInvader Addons for Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48244	medium	5.9/10	WordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48132	medium	6.5/10	WordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) Vulnerability	May 16, 2025 1y ago
CVE-2025-48131	medium	6.5/10	WordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability	May 16, 2025 1y ago
CVE-2025-2944	medium	6.4/10	Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets	May 10, 2025 1y ago
CVE-2025-47644	medium	4.7/10	WordPress Integrations of Zoho CRM with Elementor form plugin <= 1.0.8 - Open Redirection Vulnerability	May 7, 2025 1y ago
CVE-2025-47542	medium	4.3/10	WordPress Simple calendar for Elementor plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) Vulnerability	May 7, 2025 1y ago
CVE-2025-47486	medium	5.3/10	WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 3.1.9 - Broken Access Control Vulnerability	May 7, 2025 1y ago
CVE-2025-47476	medium	6.5/10	WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-39361	medium	6.5/10	WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability	May 7, 2025 1y ago
CVE-2024-12120	medium	5.4/10	Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 7, 2025 1y ago
CVE-2025-2168	medium	4.3/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update	May 1, 2025 1y ago
CVE-2025-1458	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 26, 2025 1y ago
CVE-2024-13808	high	8.8/10	Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution	Apr 26, 2025 1y ago
CVE-2025-3775	medium	6.5/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter	Apr 25, 2025 1y ago
CVE-2025-46472	medium	6.5/10	WordPress The Pack Elementor addons plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability	Apr 24, 2025 1y ago
CVE-2025-46260	medium	6.5/10	WordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2025 1y ago
CVE-2025-1054	medium	6.4/10	UiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Apr 23, 2025 1y ago
CVE-2025-46249	medium	4.3/10	WordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability	Apr 22, 2025 1y ago
CVE-2025-46225	medium	6.5/10	WordPress Post in page for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Apr 22, 2025 1y ago
CVE-2025-3103	high	7.5/10	CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read	Apr 19, 2025 1y ago
CVE-2025-3275	medium	6.4/10	Themesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 19, 2025 1y ago
CVE-2025-1457	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Apr 19, 2025 1y ago
CVE-2025-3106	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget	Apr 18, 2025 1y ago
CVE-2024-13650	medium	6.4/10	Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 18, 2025 1y ago
CVE-2025-24624	high	7.1/10	WordPress HT Event – WordPress Event Manager Plugin for Elementor Plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago