Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

349,466

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1261–1290 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-0376	medium	6.4/10	Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget	Apr 9, 2024 2y ago
CVE-2024-31357	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2024 2y ago
CVE-2024-31236	medium	6.5/10	WordPress Royal Elementor Addons plugin <= 1.3.93 - Cross Site Scripting (XSS) vulnerability	Apr 7, 2024 2y ago
CVE-2024-31346	medium	6.5/10	WordPress Gradient Text Widget for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Apr 7, 2024 2y ago
CVE-2024-2132	medium	6.4/10	Ultimate Bootstrap Elements for Elementor <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget	Apr 6, 2024 2y ago
CVE-2024-0837	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget	Apr 6, 2024 2y ago
CVE-2024-1428	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget	Apr 6, 2024 2y ago
CVE-2024-3245	medium	6.4/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block	Apr 6, 2024 2y ago
CVE-2024-2803	medium	6.4/10	ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Apr 4, 2024 2y ago
CVE-2024-2868	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout	Apr 4, 2024 2y ago
CVE-2024-3162	medium	6.4/10	Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial	Apr 3, 2024 2y ago
CVE-2024-1327	medium	6.4/10	Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box	Apr 3, 2024 2y ago
CVE-2024-2924	medium	6.4/10	Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 2, 2024 2y ago
CVE-2024-2791	medium	6.4/10	Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets	Apr 2, 2024 2y ago
CVE-2024-30524	medium	6.5/10	WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability	Mar 31, 2024 2y ago
CVE-2024-30533	high	7.5/10	WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability	Mar 31, 2024 2y ago
CVE-2024-3018	high	8.8/10	Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword	Mar 30, 2024 2y ago
CVE-2024-2491	medium	6.4/10	PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via _html_tag	Mar 30, 2024 2y ago
CVE-2024-1238	medium	6.4/10	ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 30, 2024 2y ago
CVE-2024-0367	medium	6.4/10	Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link	Mar 30, 2024 2y ago
CVE-2024-2047	high	8.8/10	ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw	Mar 30, 2024 2y ago
CVE-2024-30423	medium	6.5/10	WordPress Better Elementor Addons plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability	Mar 29, 2024 2y ago
CVE-2024-2250	medium	6.4/10	130+ Widgets \| Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 29, 2024 2y ago
CVE-2024-2280	medium	6.4/10	Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links	Mar 29, 2024 2y ago
CVE-2024-30422	medium	6.5/10	WordPress Elementor Addon Elements plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability	Mar 28, 2024 2y ago
CVE-2024-2091	medium	5.4/10	Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 28, 2024 2y ago
CVE-2024-29792	high	7.1/10	WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-30185	medium	6.5/10	WordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-30182	medium	6.5/10	WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-30177	medium	6.5/10	WordPress Exclusive Addons for Elementor plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago