Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,657

All time

Critical · Active

10,847

CVSS ≥ 9.0

New · 14 days

2,644

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25398	medium	6.5/10	WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25007	high	8.5/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability	Mar 25, 2026 3mo ago
CVE-2025-13997	medium	5.3/10	King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure	Mar 23, 2026 3mo ago
CVE-2025-6229	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`	Mar 23, 2026 3mo ago
CVE-2026-1397	medium	6.4/10	PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes	Mar 21, 2026 3mo ago
CVE-2026-2373	medium	5.3/10	Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure	Mar 17, 2026 4mo ago
CVE-2026-1870	medium	5.3/10	Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure	Mar 14, 2026 4mo ago
CVE-2026-32462	medium	5.9/10	WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32445	low	2.7/10	WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32430	medium	6.5/10	WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32429	medium	6.5/10	WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32372	medium	5.3/10	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32352	medium	6.5/10	WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-2917	medium	5.4/10	Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter	Mar 11, 2026 4mo ago
CVE-2026-2918	medium	6.4/10	Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions	Mar 11, 2026 4mo ago
CVE-2025-13067	high	8.8/10	Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass	Mar 11, 2026 4mo ago
CVE-2026-2724	high	7.2/10	Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields	Mar 10, 2026 4mo ago
CVE-2026-2599	critical	9.8/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'	Mar 5, 2026 4mo ago
CVE-2026-28135	high	8.2/10	WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability	Mar 5, 2026 4mo ago
CVE-2026-27983	critical	9.8/10	WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability	Mar 5, 2026 4mo ago
CVE-2026-27376	high	7.1/10	WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 5, 2026 4mo ago
CVE-2026-3034	medium	6.4/10	OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls	Mar 5, 2026 4mo ago
CVE-2026-2568	high	7.2/10	WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting	Mar 3, 2026 4mo ago
CVE-2026-3132	high	8.8/10	Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview	Mar 2, 2026 4mo ago
CVE-2025-14149	medium	6.4/10	Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link	Feb 27, 2026 4mo ago
CVE-2026-28131	medium	6.5/10	WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability	Feb 26, 2026 4mo ago
CVE-2026-23693	critical	9.3/10	ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint	Feb 23, 2026 4mo ago
CVE-2026-2385	medium	5.3/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay	Feb 22, 2026 4mo ago
CVE-2026-24956	critical	9.3/10	WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability	Feb 20, 2026 4mo ago
CVE-2026-22350	medium	6.5/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability	Feb 20, 2026 4mo ago