Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

352,137

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,112

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-65465	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-15787	medium	6.4/10	Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes	Jul 22, 2026 2mo ago
CVE-2026-8825	—	—	Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API	Jul 20, 2026 2mo ago
CVE-2026-10081	—	—	Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget	Jul 20, 2026 2mo ago
CVE-2026-13402	—	—	Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure	Jul 17, 2026 2mo ago
CVE-2026-61976	medium	5.3/10	WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability	Jul 13, 2026 2mo ago
CVE-2026-57804	high	7.5/10	WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability	Jul 13, 2026 2mo ago
CVE-2026-57718	high	7.1/10	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 2mo ago
CVE-2026-57376	high	7.1/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 2mo ago
CVE-2026-15338	high	7.5/10	LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting	Jul 11, 2026 2mo ago
CVE-2026-13710	medium	6.4/10	Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget	Jul 10, 2026 2mo ago
CVE-2026-15299	medium	6.4/10	Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget	Jul 10, 2026 2mo ago
CVE-2026-15285	medium	6.4/10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	Jul 10, 2026 2mo ago
CVE-2026-15284	medium	6.4/10	King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter	Jul 10, 2026 2mo ago
CVE-2026-10570	medium	6.4/10	Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values	Jul 8, 2026 2mo ago
CVE-2026-11328	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	Jul 7, 2026 2mo ago
CVE-2026-59511	medium	5.3/10	WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability	Jul 5, 2026 2mo ago
CVE-2026-9145	medium	6.5/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'	Jul 2, 2026 2mo ago
CVE-2026-11600	medium	4.3/10	Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting	Jul 2, 2026 2mo ago
CVE-2026-11380	medium	6.4/10	JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting	Jul 1, 2026 2mo ago
CVE-2026-49765	critical	9.8/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49109	critical	9.8/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49105	critical	9.8/10	WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49104	critical	9.8/10	WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-49085	critical	9.8/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2026-48870	medium	6.5/10	WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 3mo ago
CVE-2026-45437	high	7.1/10	WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 3mo ago
CVE-2026-25440	medium	5.3/10	WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability	Jun 15, 2026 3mo ago
CVE-2026-9691	critical	9.8/10	WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability	Jun 15, 2026 3mo ago
CVE-2023-25969	medium	5.4/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability	Jun 11, 2026 3mo ago