Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,613

All time

Critical · Active

10,844

CVSS ≥ 9.0

New · 14 days

2,602

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-7665	medium	5.3/10	Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler	Jun 6, 2026 1mo ago
CVE-2026-9281	medium	6.4/10	Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)	Jun 6, 2026 1mo ago
CVE-2026-49782	medium	5.4/10	WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability	Jun 2, 2026 1mo ago
CVE-2026-9243	medium	6.4/10	The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter	May 29, 2026 1mo ago
CVE-2026-49053	medium	5.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2026-49052	medium	4.3/10	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability	May 27, 2026 1mo ago
CVE-2025-0898	medium	6.5/10	Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG	May 27, 2026 1mo ago
CVE-2026-6287	medium	5.4/10	ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute	May 27, 2026 1mo ago
CVE-2026-6565	medium	6.4/10	Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title	May 27, 2026 1mo ago
CVE-2026-48837	high	8.5/10	WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability	May 25, 2026 1mo ago
CVE-2026-9018	high	8.8/10	Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter	May 22, 2026 1mo ago
CVE-2026-45443	medium	5.0/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability	May 20, 2026 1mo ago
CVE-2025-15369	medium	5.3/10	Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation	May 20, 2026 1mo ago
CVE-2026-7284	critical	9.8/10	Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register	May 20, 2026 1mo ago
CVE-2026-4885	critical	9.8/10	Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload	May 19, 2026 1mo ago
CVE-2026-6504	medium	6.4/10	Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter	May 14, 2026 2mo ago
CVE-2026-5193	medium	6.5/10	Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user	May 14, 2026 2mo ago
CVE-2026-5243	medium	6.4/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget	May 14, 2026 2mo ago
CVE-2026-5486	medium	6.5/10	Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter	May 14, 2026 2mo ago
CVE-2026-3426	medium	4.3/10	RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification	May 13, 2026 2mo ago
CVE-2026-3425	high	8.8/10	RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'	May 13, 2026 2mo ago
CVE-2026-45214	high	8.5/10	WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability	May 12, 2026 2mo ago
CVE-2026-25468	medium	5.3/10	WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability	May 7, 2026 2mo ago
CVE-2026-25436	medium	5.3/10	WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability	May 7, 2026 2mo ago
CVE-2026-27421	medium	6.5/10	WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability	May 7, 2026 2mo ago
CVE-2026-4362	medium	6.5/10	ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite	May 5, 2026 2mo ago
CVE-2026-5159	medium	6.4/10	Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter	May 5, 2026 2mo ago
CVE-2026-4803	high	7.2/10	Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta	May 5, 2026 2mo ago
CVE-2026-4790	medium	5.4/10	Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter	May 2, 2026 2mo ago
CVE-2026-4024	medium	5.3/10	Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification	May 2, 2026 2mo ago