Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

340,490

All time

Critical · Active

11,004

CVSS ≥ 9.0

New · 14 days

2,904

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 931–960 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-4626	medium	6.4/10	JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters	Jun 20, 2024 2y ago
CVE-2023-35050	medium	5.4/10	WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-48759	high	7.5/10	WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability	Jun 19, 2024 2y ago
CVE-2023-48760	high	8.2/10	WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-48761	medium	6.3/10	WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2024-4623	medium	6.4/10	Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter	Jun 19, 2024 2y ago
CVE-2024-4663	medium	6.4/10	OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	Jun 19, 2024 2y ago
CVE-2024-0845	medium	6.4/10	PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render	Jun 18, 2024 2y ago
CVE-2024-5611	medium	6.4/10	Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jun 15, 2024 2y ago
CVE-2024-4479	medium	6.4/10	Jeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets	Jun 15, 2024 2y ago
CVE-2024-5263	medium	6.4/10	ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets	Jun 15, 2024 2y ago
CVE-2024-4371	critical	9.0/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection	Jun 13, 2024 2y ago
CVE-2024-4615	medium	6.4/10	Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget	Jun 13, 2024 2y ago
CVE-2024-5787	medium	6.4/10	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget	Jun 13, 2024 2y ago
CVE-2024-5757	medium	6.4/10	Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget	Jun 13, 2024 2y ago
CVE-2024-2092	medium	5.4/10	Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget	Jun 12, 2024 2y ago
CVE-2024-3925	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events	Jun 12, 2024 2y ago
CVE-2024-4564	medium	6.4/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jun 12, 2024 2y ago
CVE-2024-5553	medium	4.4/10	Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Jun 12, 2024 2y ago
CVE-2024-4669	medium	6.4/10	Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jun 11, 2024 2y ago
CVE-2024-5189	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 11, 2024 2y ago
CVE-2023-33922	medium	4.3/10	WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2024-4266	medium	5.3/10	MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure	Jun 11, 2024 2y ago
CVE-2024-5530	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget	Jun 11, 2024 2y ago
CVE-2024-35724	medium	4.3/10	WordPress Bosa Elementor Addons and Templates for WooCommerce plugin <= 1.0.12 - Broken Access Control vulnerability	Jun 10, 2024 2y ago
CVE-2024-35725	medium	4.3/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.6 - Broken Access Control vulnerability	Jun 10, 2024 2y ago
CVE-2024-32727	medium	5.3/10	WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-32783	medium	4.3/10	WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-35660	medium	6.5/10	WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability	Jun 9, 2024 2y ago
CVE-2023-31080	high	8.3/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.65 - Multiple Broken Access Control vulnerability	Jun 9, 2024 2y ago