Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,761

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,607

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 481–510 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-2228	medium	5.7/10	Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure	Mar 26, 2025 1y ago
CVE-2025-2108	medium	6.4/10	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget	Mar 20, 2025 1y ago
CVE-2025-1526	medium	6.4/10	DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 14, 2025 1y ago
CVE-2025-1527	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module	Mar 12, 2025 1y ago
CVE-2024-10326	medium	4.3/10	RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets	Mar 8, 2025 1y ago
CVE-2024-13649	medium	6.4/10	140+ Widgets \| Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 8, 2025 1y ago
CVE-2025-1287	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Mar 8, 2025 1y ago
CVE-2024-10321	medium	4.3/10	All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates	Mar 8, 2025 1y ago
CVE-2025-1261	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget	Mar 8, 2025 1y ago
CVE-2024-13827	medium	6.1/10	Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions	Mar 5, 2025 1y ago
CVE-2025-1639	high	8.8/10	Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation	Mar 4, 2025 1y ago
CVE-2024-13832	medium	4.3/10	Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure	Feb 28, 2025 1y ago
CVE-2025-1571	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets	Feb 28, 2025 1y ago
CVE-2024-13217	medium	4.3/10	Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas	Feb 27, 2025 1y ago
CVE-2024-13734	medium	6.4/10	Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget	Feb 27, 2025 1y ago
CVE-2025-1295	high	8.8/10	Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege Escalation	Feb 27, 2025 1y ago
CVE-2025-1517	medium	6.4/10	Sina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes	Feb 26, 2025 1y ago
CVE-2024-13113	—	—	Countdown Timer for Elementor < 1.3.7 - Contributor+ Stored XSS	Feb 26, 2025 1y ago
CVE-2025-26983	medium	4.3/10	WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.3 - Broken Access Control vulnerability	Feb 25, 2025 1y ago
CVE-2025-26912	medium	6.5/10	WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability	Feb 25, 2025 1y ago
CVE-2024-54444	medium	6.5/10	WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability	Feb 25, 2025 1y ago
CVE-2024-13564	medium	6.4/10	Rife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode	Feb 22, 2025 1y ago
CVE-2024-13353	high	8.8/10	Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion	Feb 21, 2025 1y ago
CVE-2025-1039	high	7.2/10	Lenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field	Feb 20, 2025 1y ago
CVE-2024-13855	medium	4.3/10	Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode	Feb 20, 2025 1y ago
CVE-2024-13155	medium	6.4/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget	Feb 20, 2025 1y ago
CVE-2024-13445	medium	6.4/10	Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2025 1y ago
CVE-2025-0968	medium	5.3/10	ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function	Feb 19, 2025 1y ago
CVE-2024-13854	medium	4.3/10	Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode	Feb 19, 2025 1y ago
CVE-2025-1441	medium	6.1/10	Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	Feb 19, 2025 1y ago