Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,232

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,500

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-5162	medium	6.4/10	Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget	Apr 17, 2026 3mo ago
CVE-2026-1620	high	8.8/10	Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter	Apr 16, 2026 3mo ago
CVE-2026-1572	medium	6.4/10	Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings	Apr 16, 2026 3mo ago
CVE-2026-40763	medium	5.3/10	WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability	Apr 15, 2026 3mo ago
CVE-2026-40745	high	7.6/10	WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability	Apr 15, 2026 3mo ago
CVE-2026-4326	high	8.8/10	Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'	Apr 9, 2026 4mo ago
CVE-2026-39703	medium	6.5/10	WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39702	medium	6.5/10	WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39636	medium	6.5/10	WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39500	medium	6.5/10	WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-4655	medium	6.4/10	Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget	Apr 8, 2026 4mo ago
CVE-2026-3311	medium	6.4/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar	Apr 8, 2026 4mo ago
CVE-2025-14732	medium	6.4/10	Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API	Apr 8, 2026 4mo ago
CVE-2025-13368	medium	6.4/10	Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 4, 2026 4mo ago
CVE-2026-2600	medium	6.4/10	ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget	Apr 4, 2026 4mo ago
CVE-2026-0664	medium	6.4/10	Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass	Apr 4, 2026 4mo ago
CVE-2026-2949	medium	6.4/10	Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget	Apr 4, 2026 4mo ago
CVE-2025-13535	medium	6.4/10	King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets	Apr 1, 2026 4mo ago
CVE-2026-3831	medium	4.3/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode	Apr 1, 2026 4mo ago
CVE-2026-1206	medium	4.3/10	Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template	Mar 26, 2026 4mo ago
CVE-2026-32532	high	7.1/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability	Mar 25, 2026 4mo ago
CVE-2026-32527	medium	6.5/10	WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25430	medium	6.5/10	WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25398	medium	6.5/10	WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25007	high	8.5/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability	Mar 25, 2026 4mo ago
CVE-2025-13997	medium	5.3/10	King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure	Mar 23, 2026 4mo ago
CVE-2025-6229	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`	Mar 23, 2026 4mo ago
CVE-2026-1397	medium	6.4/10	PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes	Mar 21, 2026 4mo ago
CVE-2026-2373	medium	5.3/10	Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure	Mar 17, 2026 4mo ago
CVE-2026-1870	medium	5.3/10	Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure	Mar 14, 2026 4mo ago