Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,425

All time

Critical · Active

12,667

CVSS ≥ 9.0

New · 14 days

1,944

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25403	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability	Aug 6, 2026 2mo ago
CVE-2026-14872	—	—	Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter	Aug 4, 2026 2mo ago
CVE-2026-28147	medium	5.4/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability	Aug 3, 2026 2mo ago
CVE-2026-12231	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'	Aug 2, 2026 2mo ago
CVE-2026-14817	—	—	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Aug 2, 2026 2mo ago
CVE-2026-14841	—	—	King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget	Aug 2, 2026 2mo ago
CVE-2026-2916	medium	4.3/10	Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script	Aug 1, 2026 2mo ago
CVE-2026-1982	medium	5.3/10	Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget	Jul 30, 2026 2mo ago
CVE-2026-14870	—	—	Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id	Jul 28, 2026 2mo ago
CVE-2026-65534	medium	5.9/10	WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 2mo ago
CVE-2026-65505	medium	5.3/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability	Jul 23, 2026 2mo ago
CVE-2026-65503	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 2mo ago
CVE-2026-65489	medium	5.3/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability	Jul 23, 2026 2mo ago
CVE-2026-65488	high	7.1/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability	Jul 23, 2026 2mo ago
CVE-2026-65482	medium	6.5/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 2mo ago
CVE-2026-65465	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 2mo ago
CVE-2026-15787	medium	6.4/10	Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes	Jul 22, 2026 2mo ago
CVE-2026-8825	—	—	Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API	Jul 20, 2026 2mo ago
CVE-2026-10081	—	—	Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget	Jul 20, 2026 2mo ago
CVE-2026-13402	—	—	Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure	Jul 17, 2026 2mo ago
CVE-2026-61976	medium	5.3/10	WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability	Jul 13, 2026 3mo ago
CVE-2026-57804	high	7.5/10	WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability	Jul 13, 2026 3mo ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 3mo ago
CVE-2026-57376	high	7.1/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 3mo ago
CVE-2026-15338	high	7.5/10	LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting	Jul 11, 2026 3mo ago
CVE-2026-13710	medium	6.4/10	Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget	Jul 10, 2026 3mo ago
CVE-2026-15299	medium	6.4/10	Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget	Jul 10, 2026 3mo ago
CVE-2026-15285	medium	6.4/10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	Jul 10, 2026 3mo ago
CVE-2026-15284	medium	6.4/10	King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter	Jul 10, 2026 3mo ago
CVE-2026-10570	medium	6.4/10	Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values	Jul 8, 2026 3mo ago