Feed live

Elementor vulnerabilities - every known CVE across the builder and its add-ons

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Elementor's widget and template system pulls in a large third-party add-on ecosystem, which is where most disclosed CVEs originate rather than the core builder.

Total CVEs tracked

344,232

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,496

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-66159	medium	5.4/10	WordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerability	Dec 31, 2025 7mo ago
CVE-2025-66160	medium	5.4/10	WordPress Select Graphist for Elementor Graphist for Elementor plugin <= 1.2.10 - Broken Access Control vulnerability	Dec 31, 2025 7mo ago
CVE-2025-63053	medium	5.3/10	WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability	Dec 31, 2025 7mo ago
CVE-2025-69092	medium	6.5/10	WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability	Dec 30, 2025 7mo ago
CVE-2025-68981	medium	5.3/10	WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability	Dec 30, 2025 7mo ago
CVE-2023-41656	medium	5.4/10	WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability	Dec 29, 2025 7mo ago
CVE-2023-40679	medium	6.5/10	WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability	Dec 24, 2025 7mo ago
CVE-2025-68532	medium	6.5/10	WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerability	Dec 24, 2025 7mo ago
CVE-2025-68500	medium	4.9/10	WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability	Dec 24, 2025 7mo ago
CVE-2025-68494	medium	5.3/10	WordPress Premium Addons for Elementor plugin <= 4.11.53 - Sensitive Data Exposure vulnerability	Dec 24, 2025 7mo ago
CVE-2024-24844	high	7.5/10	WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability	Dec 23, 2025 7mo ago
CVE-2025-68559	medium	6.5/10	WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability	Dec 23, 2025 7mo ago
CVE-2025-68560	high	7.5/10	WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability	Dec 23, 2025 7mo ago
CVE-2025-14635	medium	6.4/10	Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS	Dec 23, 2025 7mo ago
CVE-2025-14163	medium	4.3/10	Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'	Dec 23, 2025 7mo ago
CVE-2025-14155	medium	5.3/10	Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'	Dec 23, 2025 7mo ago
CVE-2025-62094	medium	6.5/10	WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0.1.2 - Cross Site Scripting (XSS) vulnerability	Dec 22, 2025 7mo ago
CVE-2025-64355	medium	6.5/10	WordPress JetElements For Elementor plugin <= 2.7.12 - Cross Site Scripting (XSS) vulnerability	Dec 18, 2025 7mo ago
CVE-2025-14277	medium	4.3/10	Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery	Dec 18, 2025 7mo ago
CVE-2025-66116	high	7.5/10	WordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerability	Dec 18, 2025 7mo ago
CVE-2025-60084	high	8.8/10	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability	Dec 18, 2025 7mo ago
CVE-2025-13977	medium	6.4/10	Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 17, 2025 7mo ago
CVE-2025-11220	medium	6.4/10	Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path	Dec 16, 2025 7mo ago
CVE-2025-68088	medium	5.4/10	WordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-68087	medium	5.4/10	WordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-68086	medium	5.4/10	WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-68085	medium	5.4/10	WordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability	Dec 16, 2025 7mo ago
CVE-2025-67951	medium	6.5/10	WordPress WPZOOM Addons for Elementor plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66166	medium	5.4/10	WordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66163	medium	5.4/10	WordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago