Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

352,139

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,108

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-23693	critical	9.3/10	ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint	Feb 23, 2026 6mo ago
CVE-2026-2385	medium	5.3/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay	Feb 22, 2026 7mo ago
CVE-2026-24956	critical	9.3/10	WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability	Feb 20, 2026 7mo ago
CVE-2026-22350	medium	6.5/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability	Feb 20, 2026 7mo ago
CVE-2025-69382	critical	9.8/10	WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability	Feb 20, 2026 7mo ago
CVE-2025-69374	high	8.1/10	WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability	Feb 20, 2026 7mo ago
CVE-2025-68841	high	7.5/10	WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability	Feb 20, 2026 7mo ago
CVE-2025-68531	high	8.8/10	WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability	Feb 20, 2026 7mo ago
CVE-2025-67998	high	8.8/10	WordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability	Feb 20, 2026 7mo ago
CVE-2024-50555	medium	6.5/10	WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability	Feb 20, 2026 7mo ago
CVE-2026-2486	medium	6.4/10	Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'	Feb 20, 2026 7mo ago
CVE-2026-25416	medium	4.3/10	WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability	Feb 19, 2026 7mo ago
CVE-2026-25387	medium	4.3/10	WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability	Feb 19, 2026 7mo ago
CVE-2026-25320	medium	5.3/10	WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability	Feb 19, 2026 7mo ago
CVE-2026-25319	medium	4.3/10	WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability	Feb 19, 2026 7mo ago
CVE-2026-23543	medium	5.3/10	WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability	Feb 19, 2026 7mo ago
CVE-2026-2284	medium	5.4/10	News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss	Feb 19, 2026 7mo ago
CVE-2026-2386	medium	4.3/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'	Feb 18, 2026 7mo ago
CVE-2026-1793	medium	6.5/10	Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read	Feb 15, 2026 7mo ago
CVE-2026-1512	medium	6.4/10	Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget	Feb 14, 2026 7mo ago
CVE-2026-2295	medium	5.3/10	WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more	Feb 11, 2026 7mo ago
CVE-2026-25028	medium	5.4/10	WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerability	Feb 3, 2026 7mo ago
CVE-2026-24958	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerability	Feb 3, 2026 7mo ago
CVE-2026-24947	medium	4.3/10	WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerability	Feb 3, 2026 7mo ago
CVE-2026-1210	medium	6.4/10	Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field	Feb 3, 2026 7mo ago
CVE-2025-14274	medium	5.4/10	Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget	Feb 3, 2026 7mo ago
CVE-2026-1310	medium	5.3/10	Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion	Jan 28, 2026 7mo ago
CVE-2025-9082	medium	6.4/10	WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 28, 2026 7mo ago
CVE-2026-0825	medium	5.3/10	Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export	Jan 28, 2026 7mo ago
CVE-2025-14610	high	7.2/10	TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter	Jan 28, 2026 7mo ago