Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,232

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,497

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 121–150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-32462	medium	5.9/10	WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32445	low	2.7/10	WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32430	medium	6.5/10	WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32429	medium	6.5/10	WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32372	medium	5.3/10	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32352	medium	6.5/10	WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-2917	medium	5.4/10	Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter	Mar 11, 2026 5mo ago
CVE-2026-2918	medium	6.4/10	Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions	Mar 11, 2026 5mo ago
CVE-2025-13067	high	8.8/10	Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass	Mar 11, 2026 5mo ago
CVE-2026-2724	high	7.2/10	Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields	Mar 10, 2026 5mo ago
CVE-2026-2599	critical	9.8/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'	Mar 5, 2026 5mo ago
CVE-2026-28135	high	8.2/10	WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27983	critical	9.8/10	WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability	Mar 5, 2026 5mo ago
CVE-2026-27376	high	7.1/10	WordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 5, 2026 5mo ago
CVE-2026-3034	medium	6.4/10	OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls	Mar 5, 2026 5mo ago
CVE-2026-2568	high	7.2/10	WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting	Mar 3, 2026 5mo ago
CVE-2026-3132	high	8.8/10	Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview	Mar 2, 2026 5mo ago
CVE-2025-14149	medium	6.4/10	Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link	Feb 27, 2026 5mo ago
CVE-2026-28131	medium	6.5/10	WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability	Feb 26, 2026 5mo ago
CVE-2026-23693	critical	9.3/10	ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint	Feb 23, 2026 5mo ago
CVE-2026-2385	medium	5.3/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay	Feb 22, 2026 5mo ago
CVE-2026-24956	critical	9.3/10	WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability	Feb 20, 2026 5mo ago
CVE-2026-22350	medium	6.5/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability	Feb 20, 2026 5mo ago
CVE-2025-69382	critical	9.8/10	WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability	Feb 20, 2026 5mo ago
CVE-2025-69374	high	8.1/10	WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability	Feb 20, 2026 5mo ago
CVE-2025-68841	high	7.5/10	WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability	Feb 20, 2026 5mo ago
CVE-2025-68531	high	8.8/10	WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability	Feb 20, 2026 5mo ago
CVE-2025-67998	high	8.8/10	WordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability	Feb 20, 2026 5mo ago
CVE-2024-50555	medium	6.5/10	WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability	Feb 20, 2026 5mo ago
CVE-2026-2486	medium	6.4/10	Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'	Feb 20, 2026 5mo ago