Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

340,565

All time

Critical · Active

11,006

CVSS ≥ 9.0

New · 14 days

2,950

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1051–1080 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-4695	medium	6.4/10	Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 21, 2024 2y ago
CVE-2024-4875	medium	4.3/10	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update	May 21, 2024 2y ago
CVE-2024-5088	medium	6.4/10	Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 18, 2024 2y ago
CVE-2024-4432	medium	6.4/10	Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 18, 2024 2y ago
CVE-2024-4698	medium	6.4/10	Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 18, 2024 2y ago
CVE-2024-4374	medium	6.4/10	DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 18, 2024 2y ago
CVE-2024-4865	medium	6.4/10	Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter	May 18, 2024 2y ago
CVE-2024-34755	medium	4.3/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-32786	medium	5.3/10	WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-24934	high	8.5/10	WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability	May 17, 2024 2y ago
CVE-2023-50890	high	8.8/10	WordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-47679	medium	6.4/10	WordPress Qi Addons For Elementor plugin <= 1.6.3 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-47178	high	8.6/10	WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-41955	high	8.8/10	WordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-37999	critical	9.8/10	WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-34575	medium	6.5/10	WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-3134	medium	6.4/10	Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 16, 2024 2y ago
CVE-2024-2619	medium	5.0/10	Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection	May 16, 2024 2y ago
CVE-2024-4580	medium	6.4/10	Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 16, 2024 2y ago
CVE-2024-4634	medium	6.4/10	Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 16, 2024 2y ago
CVE-2024-4391	medium	6.4/10	Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget	May 16, 2024 2y ago
CVE-2024-3887	medium	5.4/10	Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget	May 16, 2024 2y ago
CVE-2024-4478	medium	6.4/10	Happy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget	May 16, 2024 2y ago
CVE-2024-4373	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer'	May 15, 2024 2y ago
CVE-2024-4618	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget	May 15, 2024 2y ago
CVE-2024-4370	medium	6.4/10	WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget	May 14, 2024 2y ago
CVE-2024-4666	medium	6.4/10	Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 14, 2024 2y ago
CVE-2024-4333	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting	May 14, 2024 2y ago
CVE-2024-4624	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 14, 2024 2y ago
CVE-2024-4440	medium	6.4/10	140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 14, 2024 2y ago