Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,232

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,500

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-6287	medium	5.4/10	ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute	May 27, 2026 2mo ago
CVE-2026-6565	medium	6.4/10	Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title	May 27, 2026 2mo ago
CVE-2026-48837	high	8.5/10	WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability	May 25, 2026 2mo ago
CVE-2026-9018	high	8.8/10	Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter	May 22, 2026 2mo ago
CVE-2026-45443	medium	5.0/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability	May 20, 2026 2mo ago
CVE-2025-15369	medium	5.3/10	Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation	May 20, 2026 2mo ago
CVE-2026-7284	critical	9.8/10	Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register	May 20, 2026 2mo ago
CVE-2026-4885	critical	9.8/10	Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload	May 19, 2026 2mo ago
CVE-2026-6504	medium	6.4/10	Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter	May 14, 2026 2mo ago
CVE-2026-5193	medium	6.5/10	Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user	May 14, 2026 2mo ago
CVE-2026-5243	medium	6.4/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget	May 14, 2026 2mo ago
CVE-2026-5486	medium	6.5/10	Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter	May 14, 2026 2mo ago
CVE-2026-3426	medium	4.3/10	RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification	May 13, 2026 2mo ago
CVE-2026-3425	high	8.8/10	RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'	May 13, 2026 2mo ago
CVE-2026-45214	high	8.5/10	WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability	May 12, 2026 2mo ago
CVE-2026-25468	medium	5.3/10	WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability	May 7, 2026 3mo ago
CVE-2026-25436	medium	5.3/10	WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability	May 7, 2026 3mo ago
CVE-2026-27421	medium	6.5/10	WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability	May 7, 2026 3mo ago
CVE-2026-4362	medium	6.5/10	ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite	May 5, 2026 3mo ago
CVE-2026-5159	medium	6.4/10	Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter	May 5, 2026 3mo ago
CVE-2026-4803	high	7.2/10	Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta	May 5, 2026 3mo ago
CVE-2026-4790	medium	5.4/10	Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter	May 2, 2026 3mo ago
CVE-2026-4024	medium	5.3/10	Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification	May 2, 2026 3mo ago
CVE-2026-6229	high	7.2/10	Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter	May 2, 2026 3mo ago
CVE-2026-6916	medium	6.4/10	Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute	May 2, 2026 3mo ago
CVE-2026-6127	medium	6.4/10	Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API	May 1, 2026 3mo ago
CVE-2026-42410	medium	6.5/10	WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability	Apr 27, 2026 3mo ago
CVE-2026-5428	medium	6.4/10	Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field	Apr 24, 2026 3mo ago
CVE-2026-6048	medium	6.4/10	Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes	Apr 18, 2026 3mo ago
CVE-2026-4659	high	7.5/10	Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal	Apr 17, 2026 3mo ago