Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-9388MEDIUMBlack Widgets For Elementor <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-5344MEDIUMThe Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register WidgetEPSS 0.3%CVE-2025-5284MEDIUMMaster Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-3275MEDIUMThemesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-47644MEDIUMWordPress Integrations of Zoho CRM with Elementor form plugin <= 1.0.8 - Open Redirection VulnerabilityEPSS 0.3%CVE-2024-8910MEDIUMHT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_idEPSS 0.3%CVE-2024-12062MEDIUMCharity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post DisclosureEPSS 0.3%CVE-2025-9698MEDIUMThe Plus Addons for Elementor < 6.3.16 - Author+ Stored XSSEPSS 0.3%CVE-2024-12059MEDIUMElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options ReadEPSS 0.3%CVE-2024-10693MEDIUMSKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post DisclosureEPSS 0.3%CVE-2024-8494MEDIUMElementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via ShortcodeEPSS 0.3%CVE-2024-9542MEDIUMSky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor TemplateEPSS 0.3%CVE-2025-30926MEDIUMWordPress King Addons for Elementor plugin <= 24.12.58 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-5542HIGHMaster Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu WidgetEPSS 0.3%CVE-2024-52486MEDIUMWordPress Elementor Portfolio Builder plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11230MEDIUMElementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title WidgetEPSS 0.3%CVE-2024-56225MEDIUMWordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-12620MEDIUMAnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.3%CVE-2023-51676MEDIUMWordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.3%CVE-2024-10321MEDIUMAll-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor TemplatesEPSS 0.3%