Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-4446MEDIUMContent Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagingType ParameterEPSS 0.4%CVE-2024-5060MEDIUMLottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-53983MEDIUMWordPress JetElements For Elementor <= 2.7.7 - Sensitive Data Exposure VulnerabilityEPSS 0.4%CVE-2026-5162MEDIUMRoyal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed WidgetEPSS 0.4%CVE-2024-13155MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero WidgetEPSS 0.4%CVE-2024-5686MEDIUMWPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetEPSS 0.4%CVE-2026-1310MEDIUMSimple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry DeletionEPSS 0.4%CVE-2025-24725MEDIUMWordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-11852MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing AuthorizationEPSS 0.4%CVE-2023-50901HIGHWordPress HT Mega Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54253MEDIUMWordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-4695MEDIUMMove Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-1238MEDIUMElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-24883MEDIUMWordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerabilityEPSS 0.4%CVE-2024-4868MEDIUMExtensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox WidgetEPSS 0.3%CVE-2026-15156MEDIUMEssential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color SettingsEPSS 0.3%CVE-2024-8858MEDIUMElementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings ParameterEPSS 0.3%CVE-2024-5504MEDIUMRife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline WidgetEPSS 0.3%CVE-2024-4697MEDIUMCowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag ParameterEPSS 0.3%CVE-2024-30186MEDIUMWordPress Prime Slider plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%