Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,236

All time

Critical · Active

11,543

CVSS ≥ 9.0

New · 14 days

2,500

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 541–570 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-12599	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Feb 11, 2025 1y ago
CVE-2024-13699	medium	6.4/10	Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 4, 2025 1y ago
CVE-2024-12046	medium	4.3/10	Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode	Feb 4, 2025 1y ago
CVE-2025-22701	medium	5.4/10	WordPress Traveler Layout Essential For Elementor plugin < 1.4 - Server Side Request Forgery (SSRF) vulnerability	Feb 3, 2025 1y ago
CVE-2025-24569	high	7.5/10	WordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.5 - Arbitrary File Read vulnerability	Feb 3, 2025 1y ago
CVE-2024-11829	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 1, 2025 1y ago
CVE-2024-12620	medium	5.3/10	AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthenticated Settings Update	Feb 1, 2025 1y ago
CVE-2024-13547	medium	6.4/10	aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 1, 2025 1y ago
CVE-2024-13216	medium	4.3/10	HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor	Jan 31, 2025 1y ago
CVE-2024-10867	medium	5.4/10	Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload	Jan 31, 2025 1y ago
CVE-2024-8494	medium	4.3/10	Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode	Jan 30, 2025 1y ago
CVE-2024-11600	high	7.2/10	Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution	Jan 30, 2025 1y ago
CVE-2024-11583	medium	4.3/10	Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.9 - Missing Authorization to Icon Font Deletion	Jan 30, 2025 1y ago
CVE-2024-13642	medium	6.4/10	Stratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget	Jan 30, 2025 1y ago
CVE-2025-24782	medium	6.5/10	WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability	Jan 27, 2025 1y ago
CVE-2025-24743	medium	4.3/10	WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability	Jan 27, 2025 1y ago
CVE-2025-24584	medium	4.3/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerability	Jan 27, 2025 1y ago
CVE-2024-13548	medium	6.4/10	Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 25, 2025 1y ago
CVE-2025-24729	medium	6.5/10	WordPress ElementInvader Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24725	medium	4.3/10	WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerability	Jan 24, 2025 1y ago
CVE-2025-24618	medium	4.3/10	WordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerability	Jan 24, 2025 1y ago
CVE-2025-24595	medium	6.5/10	WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24578	medium	6.5/10	WordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2024-10324	medium	4.3/10	RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates	Jan 24, 2025 1y ago
CVE-2024-13408	high	7.5/10	Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion	Jan 24, 2025 1y ago
CVE-2024-13354	medium	6.4/10	Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 24, 2025 1y ago
CVE-2024-13335	medium	4.3/10	Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install	Jan 24, 2025 1y ago
CVE-2024-13409	high	7.5/10	Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()	Jan 24, 2025 1y ago
CVE-2024-12043	medium	6.4/10	Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 23, 2025 1y ago
CVE-2025-22758	medium	6.5/10	WordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability	Jan 15, 2025 1y ago