Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-30562HIGHWordPress Navigation Tree Elementor plugin <= 1.0.1 - SQL Injection VulnerabilityEPSS 0.4%CVE-2024-29934MEDIUMWordPress Piotnet Addons For Elementor plugin <= 2.4.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5553MEDIUMPremium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4866MEDIUMUltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-9376MEDIUMKata Plus – Addons for Elementor – Widgets, Extensions and Templates <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2025-14980MEDIUMBetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information ExposureEPSS 0.4%CVE-2026-4341MEDIUMPrime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' ParameterEPSS 0.4%CVE-2024-11367MEDIUMSmoove connector for Elementor forms <= 4.1.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12584MEDIUM140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post DuplicationEPSS 0.4%CVE-2025-64360HIGHWordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2024-33933MEDIUMWordPress Elementor Header & Footer Builder plugin <= 1.6.35 - Contributor+ DOM-Based Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5088MEDIUMHappy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4569MEDIUMElementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-1005MEDIUMElementsKit Elementor addons <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.4%CVE-2024-2492MEDIUMPowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet WidgetEPSS 0.4%CVE-2024-48045MEDIUMWordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-4803HIGHRoyal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_metaEPSS 0.4%CVE-2026-65549HIGHWordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-13392HIGHElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)EPSS 0.4%CVE-2024-31236MEDIUMWordPress Royal Elementor Addons plugin <= 1.3.93 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%