Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

340,707

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,925

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1291–1320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-23523	medium	6.5/10	WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability	Mar 16, 2024 2y ago
CVE-2023-6525	medium	5.5/10	ElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting	Mar 16, 2024 2y ago
CVE-2024-2042	medium	6.4/10	ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget	Mar 16, 2024 2y ago
CVE-2024-1239	medium	6.4/10	ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 16, 2024 2y ago
CVE-2024-2308	medium	6.4/10	ElementInvader Addons for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 16, 2024 2y ago
CVE-2023-51407	medium	4.3/10	WordPress Split Test For Elementor plugin <= 1.6.9 - Cross Site Request Forgery (CSRF) vulnerability	Mar 16, 2024 2y ago
CVE-2024-25598	medium	6.5/10	WordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability	Mar 15, 2024 2y ago
CVE-2024-2399	medium	6.4/10	Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 15, 2024 2y ago
CVE-2024-2249	medium	6.4/10	LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 14, 2024 2y ago
CVE-2024-27986	medium	6.5/10	WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS)	Mar 14, 2024 2y ago
CVE-2024-1996	medium	6.4/10	Premium Addons for Elementor PRO <= 2.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget link	Mar 13, 2024 2y ago
CVE-2024-1413	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget	Mar 13, 2024 2y ago
CVE-2024-2252	medium	5.4/10	Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 13, 2024 2y ago
CVE-2024-2286	medium	6.4/10	Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL	Mar 13, 2024 2y ago
CVE-2024-2028	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget	Mar 13, 2024 2y ago
CVE-2024-2030	medium	6.4/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode	Mar 13, 2024 2y ago
CVE-2024-1393	medium	6.4/10	Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget	Mar 13, 2024 2y ago
CVE-2024-1391	medium	6.4/10	Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget	Mar 13, 2024 2y ago
CVE-2024-2006	high	8.8/10	Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup	Mar 13, 2024 2y ago
CVE-2024-1237	medium	6.4/10	Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 13, 2024 2y ago
CVE-2024-1537	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table	Mar 13, 2024 2y ago
CVE-2024-1680	medium	6.4/10	Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets	Mar 13, 2024 2y ago
CVE-2024-1414	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget	Mar 13, 2024 2y ago
CVE-2024-1422	medium	6.4/10	Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet	Mar 13, 2024 2y ago
CVE-2024-1585	medium	6.4/10	Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode	Mar 13, 2024 2y ago
CVE-2024-1392	medium	6.4/10	Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget	Mar 13, 2024 2y ago
CVE-2024-0326	medium	6.4/10	Premium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper	Mar 13, 2024 2y ago
CVE-2024-1358	high	8.8/10	Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion	Mar 13, 2024 2y ago
CVE-2024-1234	medium	6.4/10	Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	Mar 13, 2024 2y ago
CVE-2024-1536	high	7.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar	Mar 13, 2024 2y ago