Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,687

All time

Critical · Active

10,849

CVSS ≥ 9.0

New · 14 days

2,584

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-22468	medium	4.3/10	WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-69312	critical	9.1/10	WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability	Jan 22, 2026 5mo ago
CVE-2025-69300	medium	5.4/10	WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68999	high	8.5/10	WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability	Jan 22, 2026 5mo ago
CVE-2025-68046	medium	6.5/10	WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability	Jan 22, 2026 5mo ago
CVE-2025-67947	high	7.1/10	WordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66142	medium	5.4/10	WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66140	medium	5.4/10	WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66139	medium	5.4/10	WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66138	medium	5.4/10	WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66137	medium	5.4/10	WordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66136	medium	5.4/10	WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-66135	medium	5.4/10	WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability	Jan 22, 2026 5mo ago
CVE-2025-63026	medium	6.5/10	WordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 5mo ago
CVE-2025-31413	medium	4.3/10	WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability	Jan 22, 2026 5mo ago
CVE-2026-0920	critical	9.8/10	LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter	Jan 22, 2026 5mo ago
CVE-2026-1004	medium	5.3/10	Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure	Jan 16, 2026 6mo ago
CVE-2026-22518	medium	6.5/10	WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability	Jan 8, 2026 6mo ago
CVE-2025-14275	medium	6.4/10	Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jan 8, 2026 6mo ago
CVE-2025-46434	medium	6.5/10	WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability	Jan 7, 2026 6mo ago
CVE-2025-69363	medium	6.5/10	WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability	Jan 6, 2026 6mo ago
CVE-2025-69357	medium	6.5/10	WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability	Jan 6, 2026 6mo ago
CVE-2025-69356	high	7.5/10	WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerability	Jan 6, 2026 6mo ago
CVE-2025-69336	medium	4.3/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability	Jan 6, 2026 6mo ago
CVE-2024-23511	medium	6.5/10	WordPress The Plus Addons for Elementor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability	Jan 5, 2026 6mo ago
CVE-2025-31046	medium	4.3/10	WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability	Jan 5, 2026 6mo ago
CVE-2025-66144	medium	5.4/10	WordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability	Dec 31, 2025 6mo ago
CVE-2025-66146	medium	5.4/10	WordPress Logger for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Dec 31, 2025 6mo ago
CVE-2025-66148	medium	5.4/10	WordPress Conformer for Elementor plugin <= 1.0.7 - Broken Access Control vulnerability	Dec 31, 2025 6mo ago
CVE-2025-66151	medium	5.4/10	WordPress Countdowner for Elementor plugin <= 1.0.4 - Broken Access Control vulnerability	Dec 31, 2025 6mo ago