Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

356,020

All time

Critical · Active

12,717

CVSS ≥ 9.0

New · 14 days

2,257

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1261–1290 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-2327	medium	6.4/10	Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link	Apr 9, 2024 2y ago
CVE-2024-2117	medium	6.4/10	Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget	Apr 9, 2024 2y ago
CVE-2024-2789	medium	6.4/10	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy	Apr 9, 2024 2y ago
CVE-2024-2623	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 9, 2024 2y ago
CVE-2024-1387	medium	4.3/10	Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure	Apr 9, 2024 2y ago
CVE-2024-2348	medium	6.4/10	Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget	Apr 9, 2024 2y ago
CVE-2024-2507	medium	6.4/10	JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL	Apr 9, 2024 2y ago
CVE-2024-1465	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget	Apr 9, 2024 2y ago
CVE-2024-1464	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget	Apr 9, 2024 2y ago
CVE-2024-2974	medium	5.3/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure	Apr 9, 2024 2y ago
CVE-2024-3244	medium	6.4/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Apr 9, 2024 2y ago
CVE-2024-2788	medium	6.4/10	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag	Apr 9, 2024 2y ago
CVE-2024-2650	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 9, 2024 2y ago
CVE-2024-1466	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget	Apr 9, 2024 2y ago
CVE-2024-2786	medium	5.4/10	Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag	Apr 9, 2024 2y ago
CVE-2024-0826	medium	6.4/10	Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 9, 2024 2y ago
CVE-2024-2845	medium	6.4/10	BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Apr 9, 2024 2y ago
CVE-2024-3064	medium	6.4/10	Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 9, 2024 2y ago
CVE-2024-1974	high	8.8/10	HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal	Apr 9, 2024 2y ago
CVE-2024-2492	medium	6.4/10	PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget	Apr 9, 2024 2y ago
CVE-2024-0376	medium	6.4/10	Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget	Apr 9, 2024 2y ago
CVE-2024-31357	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2024 2y ago
CVE-2024-31236	medium	6.5/10	WordPress Royal Elementor Addons plugin <= 1.3.93 - Cross Site Scripting (XSS) vulnerability	Apr 7, 2024 2y ago
CVE-2024-31346	medium	6.5/10	WordPress Gradient Text Widget for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability	Apr 7, 2024 2y ago
CVE-2024-2132	medium	6.4/10	Ultimate Bootstrap Elements for Elementor <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget	Apr 6, 2024 2y ago
CVE-2024-0837	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget	Apr 6, 2024 2y ago
CVE-2024-1428	medium	6.4/10	Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget	Apr 6, 2024 2y ago
CVE-2024-3245	medium	6.4/10	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block	Apr 6, 2024 2y ago
CVE-2024-2803	medium	6.4/10	ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Apr 4, 2024 2y ago
CVE-2024-2868	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout	Apr 4, 2024 2y ago