Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

356,020

All time

Critical · Active

12,717

CVSS ≥ 9.0

New · 14 days

2,256

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 1381–1410 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-0766	medium	4.3/10	Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request	Feb 28, 2024 2y ago
CVE-2024-0768	medium	4.3/10	Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation	Feb 28, 2024 2y ago
CVE-2024-1698	critical	9.8/10	NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection	Feb 27, 2024 2y ago
CVE-2024-24843	high	7.1/10	WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 21, 2024 2y ago
CVE-2024-1171	medium	5.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery	Feb 20, 2024 2y ago
CVE-2024-1172	medium	5.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion	Feb 20, 2024 2y ago
CVE-2024-0838	medium	6.4/10	Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0516	medium	5.3/10	Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta	Feb 20, 2024 2y ago
CVE-2024-0512	medium	4.3/10	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist	Feb 20, 2024 2y ago
CVE-2024-1276	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0514	medium	4.3/10	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare	Feb 20, 2024 2y ago
CVE-2024-0515	medium	4.3/10	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare	Feb 20, 2024 2y ago
CVE-2024-1235	medium	6.4/10	Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-1411	medium	6.4/10	PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget	Feb 20, 2024 2y ago
CVE-2024-0506	medium	6.4/10	Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt	Feb 20, 2024 2y ago
CVE-2024-1236	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0513	medium	4.3/10	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist	Feb 20, 2024 2y ago
CVE-2024-0438	medium	6.4/10	Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0442	medium	6.4/10	Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-1242	medium	6.4/10	Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-24831	medium	6.5/10	WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability	Feb 10, 2024 2y ago
CVE-2024-0511	medium	4.3/10	Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta	Feb 8, 2024 2y ago
CVE-2024-0977	medium	4.4/10	Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 7, 2024 2y ago
CVE-2024-1055	medium	5.4/10	PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 7, 2024 2y ago
CVE-2024-0508	medium	6.4/10	Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget	Feb 5, 2024 2y ago
CVE-2024-0586	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping	Feb 5, 2024 2y ago
CVE-2024-0954	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 5, 2024 2y ago
CVE-2024-0835	medium	4.3/10	Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update	Feb 5, 2024 2y ago
CVE-2024-0585	medium	5.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl	Feb 5, 2024 2y ago
CVE-2024-0823	medium	5.4/10	Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 5, 2024 2y ago