Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,796

All time

Critical · Active

12,695

CVSS ≥ 9.0

New · 14 days

2,200

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1111–1140 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-37999	critical	9.8/10	WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-34575	medium	6.5/10	WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability	May 17, 2024 2y ago
CVE-2024-3134	medium	6.4/10	Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 16, 2024 2y ago
CVE-2024-2619	medium	5.0/10	Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection	May 16, 2024 2y ago
CVE-2024-4580	medium	6.4/10	Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 16, 2024 2y ago
CVE-2024-4634	medium	6.4/10	Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 16, 2024 2y ago
CVE-2024-4391	medium	6.4/10	Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget	May 16, 2024 2y ago
CVE-2024-3887	medium	5.4/10	Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget	May 16, 2024 2y ago
CVE-2024-4478	medium	6.4/10	Happy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget	May 16, 2024 2y ago
CVE-2024-4373	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer'	May 15, 2024 2y ago
CVE-2024-4618	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget	May 15, 2024 2y ago
CVE-2024-4370	medium	6.4/10	WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget	May 14, 2024 2y ago
CVE-2024-4666	medium	6.4/10	Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 14, 2024 2y ago
CVE-2024-4333	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting	May 14, 2024 2y ago
CVE-2024-4624	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 14, 2024 2y ago
CVE-2024-4440	medium	6.4/10	140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 14, 2024 2y ago
CVE-2024-35167	medium	6.5/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-4329	medium	6.4/10	Thim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 11, 2024 2y ago
CVE-2024-4630	medium	6.4/10	Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 11, 2024 2y ago
CVE-2024-4574	medium	6.4/10	Graphina – Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	May 10, 2024 2y ago
CVE-2024-3055	high	8.8/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection	May 10, 2024 2y ago
CVE-2024-34817	medium	4.3/10	WordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability	May 10, 2024 2y ago
CVE-2024-3547	medium	6.1/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting	May 10, 2024 2y ago
CVE-2024-4275	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'	May 10, 2024 2y ago
CVE-2024-2662	high	7.2/10	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection	May 10, 2024 2y ago
CVE-2024-4449	medium	6.4/10	Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets	May 10, 2024 2y ago
CVE-2024-4448	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'	May 10, 2024 2y ago
CVE-2024-2785	medium	6.4/10	The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate	May 9, 2024 2y ago
CVE-2024-1467	medium	4.3/10	Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery	May 9, 2024 2y ago
CVE-2024-0445	medium	6.4/10	The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 9, 2024 2y ago