Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,814

All time

Critical · Active

12,695

CVSS ≥ 9.0

New · 14 days

2,185

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1201–1230 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3985	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action	May 2, 2024 2y ago
CVE-2024-4003	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-2085	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'	May 2, 2024 2y ago
CVE-2024-3074	medium	6.4/10	Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-3005	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget	May 2, 2024 2y ago
CVE-2024-0334	medium	6.4/10	Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes	May 1, 2024 2y ago
CVE-2024-33595	medium	4.3/10	WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability	Apr 29, 2024 2y ago
CVE-2024-33635	high	7.5/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerability	Apr 29, 2024 2y ago
CVE-2024-33634	medium	5.4/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability	Apr 29, 2024 2y ago
CVE-2024-33632	medium	5.4/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Cross Site Request Forgery (CSRF) vulnerability	Apr 29, 2024 2y ago
CVE-2024-33539	medium	6.5/10	WordPress WPZOOM Addons for Elementor plugin <= 1.1.35 - Cross Site Scripting (XSS) vulnerability	Apr 29, 2024 2y ago
CVE-2024-33630	medium	6.5/10	WordPress Piotnet Addons For Elementor plugin <= 2.4.26 - Cross Site Scripting (XSS) vulnerability	Apr 29, 2024 2y ago
CVE-2024-33631	medium	6.5/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Authenticated Stored Cross Site Scripting (XSS) vulnerability	Apr 29, 2024 2y ago
CVE-2024-33633	high	7.1/10	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 29, 2024 2y ago
CVE-2024-33649	medium	6.5/10	WordPress Opal Widgets For Elementor plugin <= 1.6.9 - Cross Site Scripting (XSS) vulnerability	Apr 29, 2024 2y ago
CVE-2024-3309	medium	6.4/10	Qi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget	Apr 27, 2024 2y ago
CVE-2024-3890	medium	6.4/10	Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget	Apr 26, 2024 2y ago
CVE-2024-3733	medium	5.3/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure	Apr 25, 2024 2y ago
CVE-2024-3988	medium	6.4/10	Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget	Apr 25, 2024 2y ago
CVE-2023-47504	medium	6.5/10	WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability	Apr 24, 2024 2y ago
CVE-2023-31090	critical	9.9/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability	Apr 24, 2024 2y ago
CVE-2024-32773	medium	4.3/10	WordPress Royal Elementor Kit theme <= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32785	high	7.1/10	WordPress The Pack Elementor addons plugin <= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerability	Apr 24, 2024 2y ago
CVE-2024-32721	medium	6.5/10	WordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32791	medium	6.5/10	WordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32956	medium	6.5/10	WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32718	medium	4.9/10	WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-3889	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags	Apr 23, 2024 2y ago
CVE-2024-2798	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Apr 23, 2024 2y ago
CVE-2024-2799	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags	Apr 23, 2024 2y ago