Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-61976	medium	5.3/10	WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57804	high	7.5/10	WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-57376	high	7.1/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 1mo ago
CVE-2026-15338	high	7.5/10	LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting	Jul 11, 2026 1mo ago
CVE-2026-13710	medium	6.4/10	Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget	Jul 10, 2026 1mo ago
CVE-2026-15299	medium	6.4/10	Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget	Jul 10, 2026 1mo ago
CVE-2026-15285	medium	6.4/10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	Jul 10, 2026 1mo ago
CVE-2026-15284	medium	6.4/10	King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter	Jul 10, 2026 1mo ago
CVE-2026-10570	medium	6.4/10	Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values	Jul 8, 2026 1mo ago
CVE-2026-11328	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	Jul 7, 2026 1mo ago
CVE-2026-59511	medium	5.3/10	WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability	Jul 5, 2026 1mo ago
CVE-2026-9145	medium	6.5/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'	Jul 2, 2026 1mo ago
CVE-2026-11600	medium	4.3/10	Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting	Jul 2, 2026 1mo ago
CVE-2026-11380	medium	6.4/10	JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting	Jul 1, 2026 2mo ago
CVE-2026-49765	critical	9.8/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-49109	critical	9.8/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-49105	critical	9.8/10	WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-49104	critical	9.8/10	WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-49085	critical	9.8/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2026-48870	medium	6.5/10	WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-45437	high	7.1/10	WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 2mo ago
CVE-2026-25440	medium	5.3/10	WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability	Jun 15, 2026 2mo ago
CVE-2026-9691	critical	9.8/10	WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability	Jun 15, 2026 2mo ago
CVE-2023-25969	medium	5.4/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability	Jun 11, 2026 2mo ago
CVE-2026-8613	medium	6.4/10	aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting	Jun 10, 2026 2mo ago
CVE-2025-8444	medium	6.4/10	Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters	Jun 10, 2026 2mo ago
CVE-2026-8677	medium	6.4/10	Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings	Jun 9, 2026 2mo ago
CVE-2026-11603	medium	6.1/10	Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter	Jun 9, 2026 2mo ago
CVE-2026-7665	medium	5.3/10	Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler	Jun 6, 2026 2mo ago