Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,088

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1111–1140 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3055	high	8.8/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection	May 10, 2024 2y ago
CVE-2024-34817	medium	4.3/10	WordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-3547	medium	6.1/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting	May 10, 2024 2y ago
CVE-2024-4275	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'	May 10, 2024 2y ago
CVE-2024-2662	high	7.2/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection	May 10, 2024 2y ago
CVE-2024-4449	medium	6.4/10	Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets	May 10, 2024 2y ago
CVE-2024-4448	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'	May 10, 2024 2y ago
CVE-2024-2785	medium	6.4/10	The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate	May 9, 2024 2y ago
CVE-2024-1467	medium	4.3/10	Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery	May 9, 2024 2y ago
CVE-2024-0445	medium	6.4/10	The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 9, 2024 2y ago
CVE-2024-3990	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget	May 9, 2024 2y ago
CVE-2024-2923	medium	6.4/10	Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget	May 9, 2024 2y ago
CVE-2024-4339	medium	6.4/10	Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 9, 2024 2y ago
CVE-2024-3831	medium	6.4/10	Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget	May 9, 2024 2y ago
CVE-2024-1166	medium	6.4/10	Image Hover Effects - Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget	May 9, 2024 2y ago
CVE-2024-4316	medium	6.4/10	EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 9, 2024 2y ago
CVE-2024-3680	medium	6.4/10	Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag	May 9, 2024 2y ago
CVE-2024-4107	medium	6.4/10	Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 9, 2024 2y ago
CVE-2024-3989	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify	May 9, 2024 2y ago
CVE-2024-4606	medium	5.4/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability	May 9, 2024 2y ago
CVE-2024-34415	medium	6.5/10	WordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34421	medium	6.5/10	WordPress BlogLentor – Blog Designer Pack for Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34432	medium	6.5/10	WordPress Better Elementor Addons plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34436	medium	6.5/10	WordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34445	medium	6.5/10	WordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-24833	medium	4.3/10	WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerability	May 8, 2024 2y ago
CVE-2024-34547	medium	6.5/10	WordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34548	medium	6.5/10	WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34562	medium	6.5/10	WordPress Move Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34563	medium	6.5/10	WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago