Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

352,269

All time

Critical · Active

12,444

CVSS ≥ 9.0

New · 14 days

2,153

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1231–1260 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-31289	medium	4.3/10	WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 12, 2024 2y ago
CVE-2024-2137	medium	6.4/10	All-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets	Apr 12, 2024 2y ago
CVE-2024-2966	medium	5.3/10	Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_search	Apr 11, 2024 2y ago
CVE-2024-31278	medium	4.3/10	WordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerability	Apr 10, 2024 2y ago
CVE-2024-2655	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name	Apr 10, 2024 2y ago
CVE-2024-2539	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute	Apr 10, 2024 2y ago
CVE-2024-2666	medium	5.4/10	Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Apr 10, 2024 2y ago
CVE-2024-2664	medium	6.4/10	Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 10, 2024 2y ago
CVE-2024-2665	medium	6.4/10	Premium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button	Apr 10, 2024 2y ago
CVE-2024-2138	medium	6.4/10	JetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget	Apr 9, 2024 2y ago
CVE-2024-1498	medium	6.4/10	Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget	Apr 9, 2024 2y ago
CVE-2024-2787	medium	6.4/10	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag	Apr 9, 2024 2y ago
CVE-2024-1458	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget	Apr 9, 2024 2y ago
CVE-2024-2792	medium	6.4/10	Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget	Apr 9, 2024 2y ago
CVE-2024-1461	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget	Apr 9, 2024 2y ago
CVE-2024-2946	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget	Apr 9, 2024 2y ago
CVE-2024-2327	medium	6.4/10	Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link	Apr 9, 2024 2y ago
CVE-2024-2117	medium	6.4/10	Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget	Apr 9, 2024 2y ago
CVE-2024-2789	medium	6.4/10	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy	Apr 9, 2024 2y ago
CVE-2024-2623	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 9, 2024 2y ago
CVE-2024-1387	medium	4.3/10	Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure	Apr 9, 2024 2y ago
CVE-2024-2348	medium	6.4/10	Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget	Apr 9, 2024 2y ago
CVE-2024-2507	medium	6.4/10	JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL	Apr 9, 2024 2y ago
CVE-2024-1465	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget	Apr 9, 2024 2y ago
CVE-2024-1464	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget	Apr 9, 2024 2y ago
CVE-2024-2974	medium	5.3/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure	Apr 9, 2024 2y ago
CVE-2024-3244	medium	6.4/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Apr 9, 2024 2y ago
CVE-2024-2788	medium	6.4/10	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag	Apr 9, 2024 2y ago
CVE-2024-2650	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 9, 2024 2y ago
CVE-2024-1466	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget	Apr 9, 2024 2y ago