Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,787

All time

Critical · Active

12,693

CVSS ≥ 9.0

New · 14 days

2,218

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 931–960 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-4866	medium	6.4/10	UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jul 10, 2024 2y ago
CVE-2024-37520	medium	6.5/10	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability	Jul 9, 2024 2y ago
CVE-2024-4862	medium	6.4/10	WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jul 9, 2024 2y ago
CVE-2024-37462	high	8.5/10	WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerability	Jul 9, 2024 2y ago
CVE-2024-37455	high	8.8/10	WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability	Jul 9, 2024 2y ago
CVE-2024-37437	medium	5.5/10	WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability	Jul 9, 2024 2y ago
CVE-2024-37420	critical	9.9/10	WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability	Jul 9, 2024 2y ago
CVE-2024-37419	high	7.5/10	WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Local File Inclusion vulnerability	Jul 9, 2024 2y ago
CVE-2024-4868	medium	6.4/10	Extensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget	Jul 9, 2024 2y ago
CVE-2024-6169	medium	6.4/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'	Jul 9, 2024 2y ago
CVE-2024-6170	medium	6.4/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'	Jul 9, 2024 2y ago
CVE-2024-4667	medium	6.4/10	Blog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget	Jul 9, 2024 2y ago
CVE-2024-6166	high	8.8/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection	Jul 9, 2024 2y ago
CVE-2024-6171	medium	5.3/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass	Jul 9, 2024 2y ago
CVE-2024-37547	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerability	Jul 6, 2024 2y ago
CVE-2024-37546	medium	6.5/10	WordPress Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability	Jul 6, 2024 2y ago
CVE-2024-37541	medium	6.5/10	WordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability	Jul 6, 2024 2y ago
CVE-2024-3639	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid	Jul 4, 2024 2y ago
CVE-2024-2926	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets	Jul 4, 2024 2y ago
CVE-2024-3638	medium	6.4/10	Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets	Jul 4, 2024 2y ago
CVE-2024-2385	high	8.8/10	Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets	Jul 4, 2024 2y ago
CVE-2024-6340	medium	6.4/10	Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jul 3, 2024 2y ago
CVE-2024-4482	medium	6.4/10	The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jul 3, 2024 2y ago
CVE-2024-5260	medium	6.4/10	Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter	Jul 2, 2024 2y ago
CVE-2024-37479	high	8.5/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability	Jul 2, 2024 2y ago
CVE-2024-5504	medium	6.4/10	Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget	Jul 2, 2024 2y ago
CVE-2024-5349	high	8.8/10	LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion	Jul 2, 2024 2y ago
CVE-2024-5419	medium	6.4/10	Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute	Jul 2, 2024 2y ago
CVE-2024-5790	medium	6.4/10	Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget	Jun 29, 2024 2y ago
CVE-2024-5666	medium	6.4/10	Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter	Jun 29, 2024 2y ago