Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

340,521

All time

Critical · Active

11,005

CVSS ≥ 9.0

New · 14 days

2,917

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1021–1050 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3063	medium	6.4/10	WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 30, 2024 2y ago
CVE-2024-5086	medium	6.4/10	Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget	May 29, 2024 2y ago
CVE-2023-6743	high	8.8/10	Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import	May 29, 2024 2y ago
CVE-2024-4858	medium	5.3/10	Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update	May 25, 2024 2y ago
CVE-2024-5229	medium	6.4/10	Primary Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget	May 25, 2024 2y ago
CVE-2024-4484	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-5060	medium	6.4/10	LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-4485	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-3718	medium	6.4/10	The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box	May 24, 2024 2y ago
CVE-2024-2784	medium	6.4/10	The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card	May 24, 2024 2y ago
CVE-2024-2618	medium	6.4/10	Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-4471	high	8.0/10	140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection	May 23, 2024 2y ago
CVE-2024-1803	medium	4.3/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual	May 23, 2024 2y ago
CVE-2024-4378	medium	6.4/10	Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider	May 23, 2024 2y ago
CVE-2024-3997	medium	6.4/10	Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget	May 23, 2024 2y ago
CVE-2024-4779	high	8.8/10	Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]	May 23, 2024 2y ago
CVE-2023-6325	medium	5.3/10	RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate	May 23, 2024 2y ago
CVE-2024-4431	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 23, 2024 2y ago
CVE-2024-4486	medium	6.4/10	Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget	May 23, 2024 2y ago
CVE-2024-3926	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes	May 22, 2024 2y ago
CVE-2024-4262	medium	6.4/10	Piotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes	May 22, 2024 2y ago
CVE-2024-4896	medium	6.4/10	WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter	May 22, 2024 2y ago
CVE-2024-5147	critical	9.8/10	WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion	May 22, 2024 2y ago
CVE-2024-3927	medium	5.3/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass	May 22, 2024 2y ago
CVE-2024-3066	medium	6.4/10	Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags	May 22, 2024 2y ago
CVE-2024-5092	medium	6.4/10	Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets	May 22, 2024 2y ago
CVE-2024-3611	medium	6.4/10	Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 22, 2024 2y ago
CVE-2024-4980	medium	6.4/10	WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters	May 22, 2024 2y ago
CVE-2024-4619	medium	6.4/10	Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 21, 2024 2y ago
CVE-2024-4876	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 21, 2024 2y ago