Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,230

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,505

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-15299	medium	6.4/10	Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget	Jul 10, 2026 29d ago
CVE-2026-15285	medium	6.4/10	The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	Jul 10, 2026 29d ago
CVE-2026-15284	medium	6.4/10	King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter	Jul 10, 2026 29d ago
CVE-2026-10570	medium	6.4/10	Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values	Jul 8, 2026 1mo ago
CVE-2026-11328	medium	6.4/10	Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	Jul 7, 2026 1mo ago
CVE-2026-59511	medium	5.3/10	WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability	Jul 5, 2026 1mo ago
CVE-2026-9145	medium	6.5/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'	Jul 2, 2026 1mo ago
CVE-2026-11600	medium	4.3/10	Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting	Jul 2, 2026 1mo ago
CVE-2026-11380	medium	6.4/10	JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting	Jul 1, 2026 1mo ago
CVE-2026-49765	critical	9.8/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49109	critical	9.8/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49105	critical	9.8/10	WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49104	critical	9.8/10	WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-49085	critical	9.8/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2026-48870	medium	6.5/10	WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-45437	high	7.1/10	WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability	Jun 15, 2026 1mo ago
CVE-2026-25440	medium	5.3/10	WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability	Jun 15, 2026 1mo ago
CVE-2026-9691	critical	9.8/10	WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability	Jun 15, 2026 1mo ago
CVE-2023-25969	medium	5.4/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability	Jun 11, 2026 1mo ago
CVE-2026-8613	medium	6.4/10	aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting	Jun 10, 2026 1mo ago
CVE-2025-8444	medium	6.4/10	Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters	Jun 10, 2026 1mo ago
CVE-2026-8677	medium	6.4/10	Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings	Jun 9, 2026 2mo ago
CVE-2026-11603	medium	6.1/10	Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter	Jun 9, 2026 2mo ago
CVE-2026-7665	medium	5.3/10	Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler	Jun 6, 2026 2mo ago
CVE-2026-9281	medium	6.4/10	Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)	Jun 6, 2026 2mo ago
CVE-2026-49782	medium	5.4/10	WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability	Jun 2, 2026 2mo ago
CVE-2026-9243	medium	6.4/10	The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter	May 29, 2026 2mo ago
CVE-2026-49053	medium	5.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 2mo ago
CVE-2026-49052	medium	4.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 2mo ago
CVE-2025-0898	medium	6.5/10	Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG	May 27, 2026 2mo ago