Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

355,539

All time

Critical · Active

12,683

CVSS ≥ 9.0

New · 14 days

2,042

Newly disclosed

Feed last synced

55 mins ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-66136	medium	5.4/10	WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability	Jan 22, 2026 8mo ago
CVE-2025-66135	medium	5.4/10	WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability	Jan 22, 2026 8mo ago
CVE-2025-63026	medium	6.5/10	WordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2026 8mo ago
CVE-2025-31413	medium	4.3/10	WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability	Jan 22, 2026 8mo ago
CVE-2026-0920	critical	9.8/10	LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter	Jan 22, 2026 8mo ago
CVE-2026-1004	medium	5.3/10	Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure	Jan 16, 2026 9mo ago
CVE-2026-22518	medium	6.5/10	WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability	Jan 8, 2026 9mo ago
CVE-2025-14275	medium	6.4/10	Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	Jan 8, 2026 9mo ago
CVE-2025-46434	medium	6.5/10	WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability	Jan 7, 2026 9mo ago
CVE-2025-69363	medium	6.5/10	WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability	Jan 6, 2026 9mo ago
CVE-2025-69357	medium	6.5/10	WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability	Jan 6, 2026 9mo ago
CVE-2025-69356	high	7.5/10	WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerability	Jan 6, 2026 9mo ago
CVE-2025-69336	medium	4.3/10	WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability	Jan 6, 2026 9mo ago
CVE-2024-23511	medium	6.5/10	WordPress The Plus Addons for Elementor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability	Jan 5, 2026 9mo ago
CVE-2025-31046	medium	4.3/10	WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability	Jan 5, 2026 9mo ago
CVE-2025-66144	medium	5.4/10	WordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66146	medium	5.4/10	WordPress Logger for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66148	medium	5.4/10	WordPress Conformer for Elementor plugin <= 1.0.7 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66151	medium	5.4/10	WordPress Countdowner for Elementor plugin <= 1.0.4 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66152	medium	5.4/10	WordPress Criptopayer for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66153	medium	5.4/10	WordPress Headinger for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66154	medium	5.4/10	WordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66155	medium	5.4/10	WordPress Questionar for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66156	medium	5.4/10	WordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66157	medium	5.4/10	WordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66158	medium	5.4/10	WordPress Gmaper for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66159	medium	5.4/10	WordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-66160	medium	5.4/10	WordPress Select Graphist for Elementor Graphist for Elementor plugin <= 1.2.10 - Broken Access Control vulnerability	Dec 31, 2025 9mo ago
CVE-2025-63053	medium	5.3/10	WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability	Dec 31, 2025 9mo ago
CVE-2025-69092	medium	6.5/10	WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability	Dec 30, 2025 9mo ago