Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

352,251

All time

Critical · Active

12,441

CVSS ≥ 9.0

New · 14 days

2,160

Newly disclosed

Feed last synced

37 mins ago

Data freshness

Showing 931–960 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-37547	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerability	Jul 6, 2024 2y ago
CVE-2024-37546	medium	6.5/10	WordPress Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability	Jul 6, 2024 2y ago
CVE-2024-37541	medium	6.5/10	WordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability	Jul 6, 2024 2y ago
CVE-2024-3639	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid	Jul 4, 2024 2y ago
CVE-2024-2926	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets	Jul 4, 2024 2y ago
CVE-2024-3638	medium	6.4/10	Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets	Jul 4, 2024 2y ago
CVE-2024-2385	high	8.8/10	Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets	Jul 4, 2024 2y ago
CVE-2024-6340	medium	6.4/10	Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jul 3, 2024 2y ago
CVE-2024-4482	medium	6.4/10	The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jul 3, 2024 2y ago
CVE-2024-5260	medium	6.4/10	Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter	Jul 2, 2024 2y ago
CVE-2024-37479	high	8.5/10	WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability	Jul 2, 2024 2y ago
CVE-2024-5504	medium	6.4/10	Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget	Jul 2, 2024 2y ago
CVE-2024-5349	high	8.8/10	LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion	Jul 2, 2024 2y ago
CVE-2024-5419	medium	6.4/10	Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute	Jul 2, 2024 2y ago
CVE-2024-5790	medium	6.4/10	Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget	Jun 29, 2024 2y ago
CVE-2024-5666	medium	6.4/10	Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter	Jun 29, 2024 2y ago
CVE-2024-5662	medium	6.4/10	Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget	Jun 28, 2024 2y ago
CVE-2024-4983	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-6283	medium	5.4/10	DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget	Jun 27, 2024 2y ago
CVE-2024-4570	medium	6.4/10	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-4569	medium	6.4/10	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-5215	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jun 26, 2024 2y ago
CVE-2024-5332	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget	Jun 26, 2024 2y ago
CVE-2024-5173	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings	Jun 26, 2024 2y ago
CVE-2024-3249	medium	4.3/10	Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification	Jun 25, 2024 2y ago
CVE-2024-37092	high	8.5/10	WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerability	Jun 24, 2024 2y ago
CVE-2024-37091	critical	9.9/10	WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability	Jun 24, 2024 2y ago
CVE-2024-37089	critical	9.0/10	WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability	Jun 24, 2024 2y ago
CVE-2024-4313	medium	6.4/10	Table Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter	Jun 22, 2024 2y ago
CVE-2024-5455	high	8.8/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion	Jun 21, 2024 2y ago