Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-3309MEDIUMQi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widgetEPSS 0.3%CVE-2024-1426MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List WidgetEPSS 0.3%CVE-2024-1429MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider WidgetEPSS 0.3%CVE-2024-1521MEDIUMElementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File UploadEPSS 0.3%CVE-2024-2791MEDIUMMetform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via WidgetsEPSS 0.3%CVE-2026-2917MEDIUMHappy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' ParameterEPSS 0.3%CVE-2024-12597MEDIUMHT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_cssEPSS 0.3%CVE-2026-2568HIGHWP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-10787MEDIUMLA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post DisclosureEPSS 0.3%CVE-2024-10777MEDIUMAnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post DisclosureEPSS 0.3%CVE-2024-13216MEDIUMHT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: SponsorEPSS 0.3%CVE-2024-32508MEDIUMWordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53796MEDIUMWordPress Themesflat Addons For Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5382MEDIUMMaster Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or ModificationEPSS 0.3%CVE-2024-38681MEDIUMWordPress Magical Addons For Elementor plugin <= 1.1.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38674MEDIUMWordPress SKT Addons for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-25598MEDIUMWordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29107MEDIUMWordPress Elementor Addon Elements plugin <= 1.12.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30177MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30232MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%