Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,795

All time

Critical · Active

12,695

CVSS ≥ 9.0

New · 14 days

2,204

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1021–1050 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-4887	high	7.5/10	Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion	Jun 7, 2024 2y ago
CVE-2024-5188	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 6, 2024 2y ago
CVE-2024-5329	high	8.8/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter	Jun 6, 2024 2y ago
CVE-2024-5152	medium	6.4/10	ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 6, 2024 2y ago
CVE-2024-5161	medium	6.4/10	Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 6, 2024 2y ago
CVE-2024-5153	critical	9.1/10	Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion	Jun 6, 2024 2y ago
CVE-2024-4458	medium	6.4/10	Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs	Jun 6, 2024 2y ago
CVE-2024-4212	medium	6.4/10	Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets	Jun 6, 2024 2y ago
CVE-2024-4459	medium	6.4/10	Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles	Jun 6, 2024 2y ago
CVE-2024-2922	medium	6.4/10	Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags	Jun 6, 2024 2y ago
CVE-2024-4364	medium	6.4/10	Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget	Jun 6, 2024 2y ago
CVE-2024-5179	high	8.8/10	Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion	Jun 6, 2024 2y ago
CVE-2024-2350	medium	6.4/10	Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets	Jun 6, 2024 2y ago
CVE-2024-5001	medium	6.4/10	Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters	Jun 6, 2024 2y ago
CVE-2024-0910	medium	5.3/10	Restrict for Elementor <= 1.0.7 - Protection Mechanism Bypass	Jun 6, 2024 2y ago
CVE-2024-4788	medium	4.3/10	Boostify Header Footer Builder for Elementor <= 1.3.5 - Missing Authorization to Page/Post Creation	Jun 6, 2024 2y ago
CVE-2024-35674	medium	4.3/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerability	Jun 5, 2024 2y ago
CVE-2024-5571	medium	6.4/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	Jun 5, 2024 2y ago
CVE-2024-5006	medium	6.4/10	Boostify Header Footer Builder for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter	Jun 5, 2024 2y ago
CVE-2024-30525	medium	5.3/10	WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability	Jun 4, 2024 2y ago
CVE-2024-35666	medium	6.5/10	WordPress Themesflat Addons For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-35782	medium	6.5/10	WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability	Jun 4, 2024 2y ago
CVE-2024-34384	medium	6.5/10	WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33541	medium	6.5/10	WordPress Better Elementor Addons plugin <= 1.4.1 - Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-4637	medium	6.4/10	Slider Revolution <= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex	Jun 4, 2024 2y ago
CVE-2023-33930	critical	9.1/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerability	Jun 4, 2024 2y ago
CVE-2024-4697	medium	6.4/10	Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parameter	Jun 4, 2024 2y ago
CVE-2024-35632	medium	4.3/10	WordPress Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability	Jun 3, 2024 2y ago
CVE-2024-34789	medium	6.5/10	WordPress Post Grid Elementor Addon plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago
CVE-2024-34791	medium	6.5/10	WordPress WPB Elementor Addons plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago