Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

339,703

All time

Critical · Active

10,851

CVSS ≥ 9.0

New · 14 days

2,582

Newly disclosed

Feed last synced

42 mins ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-68088	medium	5.4/10	WordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-68087	medium	5.4/10	WordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-68086	medium	5.4/10	WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-68085	medium	5.4/10	WordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability	Dec 16, 2025 7mo ago
CVE-2025-67951	medium	6.5/10	WordPress WPZOOM Addons for Elementor plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66166	medium	5.4/10	WordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66163	medium	5.4/10	WordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66162	medium	5.4/10	WordPress Spoter for Elementor plugin <= 1.04 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66161	medium	5.4/10	WordPress Grider for Elementor plugin <= 1.0.8 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66147	medium	5.4/10	WordPress Coder for Elementor plugin <= 1.0.13 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-64244	medium	4.3/10	WordPress Restrict Elementor Widgets, Columns and Sections plugin <= 1.12 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-11363	—	—	Royal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File Upload	Dec 15, 2025 7mo ago
CVE-2025-12537	medium	6.4/10	Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 14, 2025 7mo ago
CVE-2025-8195	medium	6.4/10	JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets	Dec 13, 2025 7mo ago
CVE-2025-7960	medium	6.4/10	King Addons for Elementor <= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Dec 13, 2025 7mo ago
CVE-2025-8779	medium	6.4/10	All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets	Dec 13, 2025 7mo ago
CVE-2025-14278	medium	6.4/10	HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 13, 2025 7mo ago
CVE-2025-12830	medium	6.4/10	Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget	Dec 12, 2025 7mo ago
CVE-2025-63077	medium	4.3/10	WordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-63055	medium	6.5/10	WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability	Dec 9, 2025 7mo ago
CVE-2025-63044	medium	6.5/10	WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Cross Site Scripting (XSS) vulnerability	Dec 9, 2025 7mo ago
CVE-2025-63042	medium	6.5/10	WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability	Dec 9, 2025 7mo ago
CVE-2025-63033	medium	5.9/10	WordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67594	medium	4.3/10	WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67588	medium	4.3/10	WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67540	medium	6.5/10	WordPress Animation Addons for Elementor plugin <= 2.4.5 - Arbitrary Content Deletion vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67524	high	7.5/10	WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67468	medium	4.3/10	WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-13692	high	7.2/10	Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload	Nov 27, 2025 7mo ago
CVE-2025-13141	medium	6.4/10	HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection	Nov 21, 2025 7mo ago