Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,646

All time

Critical · Active

10,844

CVSS ≥ 9.0

New · 14 days

2,634

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-6229	high	7.2/10	Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter	May 2, 2026 2mo ago
CVE-2026-6916	medium	6.4/10	Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute	May 2, 2026 2mo ago
CVE-2026-6127	medium	6.4/10	Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API	May 1, 2026 2mo ago
CVE-2026-42410	medium	6.5/10	WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability	Apr 27, 2026 2mo ago
CVE-2026-5428	medium	6.4/10	Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field	Apr 24, 2026 2mo ago
CVE-2026-6048	medium	6.4/10	Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes	Apr 18, 2026 3mo ago
CVE-2026-4659	high	7.5/10	Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal	Apr 17, 2026 3mo ago
CVE-2026-5162	medium	6.4/10	Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget	Apr 17, 2026 3mo ago
CVE-2026-1620	high	8.8/10	Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter	Apr 16, 2026 3mo ago
CVE-2026-1572	medium	6.4/10	Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings	Apr 16, 2026 3mo ago
CVE-2026-40763	medium	5.3/10	WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability	Apr 15, 2026 3mo ago
CVE-2026-40745	high	7.6/10	WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability	Apr 15, 2026 3mo ago
CVE-2026-4326	high	8.8/10	Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'	Apr 9, 2026 3mo ago
CVE-2026-39703	medium	6.5/10	WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39702	medium	6.5/10	WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39636	medium	6.5/10	WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39500	medium	6.5/10	WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-4655	medium	6.4/10	Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget	Apr 8, 2026 3mo ago
CVE-2026-3311	medium	6.4/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar	Apr 8, 2026 3mo ago
CVE-2025-14732	medium	6.4/10	Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API	Apr 8, 2026 3mo ago
CVE-2025-13368	medium	6.4/10	Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 4, 2026 3mo ago
CVE-2026-2600	medium	6.4/10	ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget	Apr 4, 2026 3mo ago
CVE-2026-0664	medium	6.4/10	Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass	Apr 4, 2026 3mo ago
CVE-2026-2949	medium	6.4/10	Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget	Apr 4, 2026 3mo ago
CVE-2025-13535	medium	6.4/10	King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets	Apr 1, 2026 3mo ago
CVE-2026-3831	medium	4.3/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode	Apr 1, 2026 3mo ago
CVE-2026-1206	medium	4.3/10	Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template	Mar 26, 2026 3mo ago
CVE-2026-32532	high	7.1/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability	Mar 25, 2026 3mo ago
CVE-2026-32527	medium	6.5/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25430	medium	6.5/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago