Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,790

All time

Critical · Active

12,695

CVSS ≥ 9.0

New · 14 days

2,221

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 961–990 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-5662	medium	6.4/10	Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget	Jun 28, 2024 2y ago
CVE-2024-4983	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-6283	medium	5.4/10	DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget	Jun 27, 2024 2y ago
CVE-2024-4570	medium	6.4/10	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-4569	medium	6.4/10	Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-5215	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jun 26, 2024 2y ago
CVE-2024-5332	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget	Jun 26, 2024 2y ago
CVE-2024-5173	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings	Jun 26, 2024 2y ago
CVE-2024-3249	medium	4.3/10	Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification	Jun 25, 2024 2y ago
CVE-2024-37092	high	8.5/10	WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerability	Jun 24, 2024 2y ago
CVE-2024-37091	critical	9.9/10	WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability	Jun 24, 2024 2y ago
CVE-2024-37089	critical	9.0/10	WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability	Jun 24, 2024 2y ago
CVE-2024-4313	medium	6.4/10	Table Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter	Jun 22, 2024 2y ago
CVE-2024-5455	high	8.8/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion	Jun 21, 2024 2y ago
CVE-2024-5344	medium	6.1/10	The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget	Jun 21, 2024 2y ago
CVE-2024-5036	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Jun 20, 2024 2y ago
CVE-2024-5686	medium	6.4/10	WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget	Jun 20, 2024 2y ago
CVE-2024-4626	medium	6.4/10	JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters	Jun 20, 2024 2y ago
CVE-2023-35050	medium	5.4/10	WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-48759	high	7.5/10	WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability	Jun 19, 2024 2y ago
CVE-2023-48760	high	8.2/10	WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-48761	medium	6.3/10	WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2024-4623	medium	6.4/10	Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter	Jun 19, 2024 2y ago
CVE-2024-4663	medium	6.4/10	OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	Jun 19, 2024 2y ago
CVE-2024-0845	medium	6.4/10	PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render	Jun 18, 2024 2y ago
CVE-2024-5611	medium	6.4/10	Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jun 15, 2024 2y ago
CVE-2024-4479	medium	6.4/10	Jeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets	Jun 15, 2024 2y ago
CVE-2024-5263	medium	6.4/10	ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets	Jun 15, 2024 2y ago
CVE-2024-4371	critical	9.0/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection	Jun 13, 2024 2y ago
CVE-2024-4615	medium	6.4/10	Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget	Jun 13, 2024 2y ago