Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,088

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1201–1230 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-31090	critical	9.9/10	WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability	Apr 24, 2024 2y ago
CVE-2024-32773	medium	4.3/10	WordPress Royal Elementor Kit theme <= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32785	high	7.1/10	WordPress The Pack Elementor addons plugin <= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerability	Apr 24, 2024 2y ago
CVE-2024-32721	medium	6.5/10	WordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32791	medium	6.5/10	WordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32956	medium	6.5/10	WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32718	medium	4.9/10	WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-3889	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags	Apr 23, 2024 2y ago
CVE-2024-2798	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Apr 23, 2024 2y ago
CVE-2024-2799	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags	Apr 23, 2024 2y ago
CVE-2024-3645	medium	6.4/10	Essential Addons for Elementor Pro <= 5.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_html_tag'	Apr 22, 2024 2y ago
CVE-2024-32698	medium	6.5/10	WordPress Happy Addons for Elementor plugin <= 3.10.4 - Cross Site Scripting (XSS) vulnerability	Apr 22, 2024 2y ago
CVE-2024-1730	medium	5.4/10	Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 20, 2024 2y ago
CVE-2024-1057	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 20, 2024 2y ago
CVE-2024-32572	medium	6.5/10	WordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability	Apr 18, 2024 2y ago
CVE-2024-32592	medium	6.5/10	WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability	Apr 18, 2024 2y ago
CVE-2024-32593	medium	6.5/10	WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.3.4.2 - Cross Site Scripting (XSS) vulnerability	Apr 18, 2024 2y ago
CVE-2024-1429	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget	Apr 18, 2024 2y ago
CVE-2024-1426	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget	Apr 18, 2024 2y ago
CVE-2024-3333	medium	6.4/10	Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute	Apr 17, 2024 2y ago
CVE-2024-32505	medium	6.5/10	WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability	Apr 17, 2024 2y ago
CVE-2024-32508	medium	6.5/10	WordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability	Apr 17, 2024 2y ago
CVE-2024-32515	medium	5.4/10	WordPress Mega Addons For Elementor plugin <= 1.8 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-32557	medium	6.5/10	WordPress Exclusive Addons for Elementor plugin <= 2.6.9.2 - Cross Site Scripting (XSS) vulnerability	Apr 16, 2024 2y ago
CVE-2024-31289	medium	4.3/10	WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 12, 2024 2y ago
CVE-2024-2137	medium	6.4/10	All-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets	Apr 12, 2024 2y ago
CVE-2024-2966	medium	5.3/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_search	Apr 11, 2024 2y ago
CVE-2024-31278	medium	4.3/10	WordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerability	Apr 10, 2024 2y ago
CVE-2024-2655	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name	Apr 10, 2024 2y ago
CVE-2024-2539	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute	Apr 10, 2024 2y ago