Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

340,496

All time

Critical · Active

11,005

CVSS ≥ 9.0

New · 14 days

2,907

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 991–1020 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-35674	medium	4.3/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerability	Jun 5, 2024 2y ago
CVE-2024-5571	medium	6.4/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	Jun 5, 2024 2y ago
CVE-2024-5006	medium	6.4/10	Boostify Header Footer Builder for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter	Jun 5, 2024 2y ago
CVE-2024-30525	medium	5.3/10	WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability	Jun 4, 2024 2y ago
CVE-2024-35666	medium	6.5/10	WordPress Themesflat Addons For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-35782	medium	6.5/10	WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-34384	medium	6.5/10	WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33541	medium	6.5/10	WordPress Better Elementor Addons plugin <= 1.4.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-4637	medium	6.4/10	Slider Revolution <= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex	Jun 4, 2024 2y ago
CVE-2023-33930	critical	9.1/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerability	Jun 4, 2024 2y ago
CVE-2024-4697	medium	6.4/10	Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parameter	Jun 4, 2024 2y ago
CVE-2024-35632	medium	4.3/10	WordPress Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-34789	medium	6.5/10	WordPress Post Grid Elementor Addon plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-34791	medium	6.5/10	WordPress WPB Elementor Addons plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-5348	high	8.8/10	Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes	Jun 1, 2024 2y ago
CVE-2024-4087	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget	Jun 1, 2024 2y ago
CVE-2024-4342	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 1, 2024 2y ago
CVE-2024-5041	medium	6.4/10	Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion	May 31, 2024 2y ago
CVE-2024-5347	medium	6.4/10	Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget	May 31, 2024 2y ago
CVE-2024-4379	medium	5.4/10	Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip	May 31, 2024 2y ago
CVE-2024-4376	medium	6.4/10	Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget	May 31, 2024 2y ago
CVE-2024-4205	medium	4.3/10	Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure	May 31, 2024 2y ago
CVE-2024-5418	medium	6.4/10	DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute	May 31, 2024 2y ago
CVE-2024-5345	high	8.8/10	Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion	May 31, 2024 2y ago
CVE-2024-4668	medium	6.4/10	Gum Elementor Addon <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price Table and Post Slider Widgets	May 30, 2024 2y ago
CVE-2024-5327	medium	6.4/10	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 30, 2024 2y ago
CVE-2024-5073	medium	6.4/10	Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed	May 30, 2024 2y ago
CVE-2024-5341	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget	May 30, 2024 2y ago
CVE-2024-2253	medium	6.4/10	Testimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 30, 2024 2y ago
CVE-2024-3190	medium	5.4/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field	May 30, 2024 2y ago