Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,796

All time

Critical · Active

12,695

CVSS ≥ 9.0

New · 14 days

2,191

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1141–1170 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3990	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget	May 9, 2024 2y ago
CVE-2024-2923	medium	6.4/10	Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget	May 9, 2024 2y ago
CVE-2024-4339	medium	6.4/10	Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 9, 2024 2y ago
CVE-2024-3831	medium	6.4/10	Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget	May 9, 2024 2y ago
CVE-2024-1166	medium	6.4/10	Image Hover Effects - Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget	May 9, 2024 2y ago
CVE-2024-4316	medium	6.4/10	EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 9, 2024 2y ago
CVE-2024-3680	medium	6.4/10	Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag	May 9, 2024 2y ago
CVE-2024-4107	medium	6.4/10	Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 9, 2024 2y ago
CVE-2024-3989	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify	May 9, 2024 2y ago
CVE-2024-4606	medium	5.4/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability	May 9, 2024 2y ago
CVE-2024-34415	medium	6.5/10	WordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34421	medium	6.5/10	WordPress BlogLentor – Blog Designer Pack for Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34432	medium	6.5/10	WordPress Better Elementor Addons plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34436	medium	6.5/10	WordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-34445	medium	6.5/10	WordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 9, 2024 2y ago
CVE-2024-24833	medium	4.3/10	WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerability	May 8, 2024 2y ago
CVE-2024-34547	medium	6.5/10	WordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34548	medium	6.5/10	WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34562	medium	6.5/10	WordPress Move Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34563	medium	6.5/10	WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34570	medium	5.9/10	WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-34572	medium	6.5/10	WordPress Fancy Elementor Flipbox plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability	May 8, 2024 2y ago
CVE-2024-4346	critical	9.1/10	Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion	May 7, 2024 2y ago
CVE-2024-4345	critical	9.8/10	Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload	May 7, 2024 2y ago
CVE-2024-34373	medium	6.5/10	WordPress The Plus Addons for Elementor plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability	May 6, 2024 2y ago
CVE-2024-34374	medium	6.5/10	WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability	May 6, 2024 2y ago
CVE-2024-33914	medium	4.3/10	WordPress Exclusive Addons for Elementor plugin <= 2.6.9.1 - Broken Access Control on Post Duplication vulnerability	May 3, 2024 2y ago
CVE-2024-33919	medium	6.5/10	WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability	May 3, 2024 2y ago
CVE-2024-33945	medium	6.5/10	WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability	May 3, 2024 2y ago
CVE-2024-3936	medium	4.3/10	The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization	May 2, 2024 2y ago