Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,795

All time

Critical · Active

12,695

CVSS ≥ 9.0

New · 14 days

2,200

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1081–1110 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3997	medium	6.4/10	Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget	May 23, 2024 2y ago
CVE-2024-4779	high	8.8/10	Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]	May 23, 2024 2y ago
CVE-2023-6325	medium	5.3/10	RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate	May 23, 2024 2y ago
CVE-2024-4431	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 23, 2024 2y ago
CVE-2024-4486	medium	6.4/10	Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget	May 23, 2024 2y ago
CVE-2024-3926	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes	May 22, 2024 2y ago
CVE-2024-4262	medium	6.4/10	Piotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes	May 22, 2024 2y ago
CVE-2024-4896	medium	6.4/10	WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter	May 22, 2024 2y ago
CVE-2024-5147	critical	9.8/10	WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion	May 22, 2024 2y ago
CVE-2024-3927	medium	5.3/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass	May 22, 2024 2y ago
CVE-2024-3066	medium	6.4/10	Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags	May 22, 2024 2y ago
CVE-2024-5092	medium	6.4/10	Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets	May 22, 2024 2y ago
CVE-2024-3611	medium	6.4/10	Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 22, 2024 2y ago
CVE-2024-4980	medium	6.4/10	WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters	May 22, 2024 2y ago
CVE-2024-4619	medium	6.4/10	Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 21, 2024 2y ago
CVE-2024-4876	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 21, 2024 2y ago
CVE-2024-4695	medium	6.4/10	Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 21, 2024 2y ago
CVE-2024-4875	medium	4.3/10	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update	May 21, 2024 2y ago
CVE-2024-5088	medium	6.4/10	Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 18, 2024 2y ago
CVE-2024-4432	medium	6.4/10	Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 18, 2024 2y ago
CVE-2024-4698	medium	6.4/10	Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 18, 2024 2y ago
CVE-2024-4374	medium	6.4/10	DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 18, 2024 2y ago
CVE-2024-4865	medium	6.4/10	Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter	May 18, 2024 2y ago
CVE-2024-34755	medium	4.3/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability	May 17, 2024 2y ago
CVE-2024-32786	medium	5.3/10	WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerability	May 17, 2024 2y ago
CVE-2024-24934	high	8.5/10	WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability	May 17, 2024 2y ago
CVE-2023-50890	high	8.8/10	WordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-47679	medium	6.4/10	WordPress Qi Addons For Elementor plugin <= 1.6.3 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-47178	high	8.6/10	WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-41955	high	8.8/10	WordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerability	May 17, 2024 2y ago