Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-53774MEDIUMWordPress Sparkle Elementor Kit plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53766MEDIUMWordPress Devnex Addons For Elementor plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12851MEDIUMElement Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12852MEDIUMHappy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22316MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7499MEDIUMBetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information DisclosureEPSS 0.3%CVE-2026-66575MEDIUMWordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-25440MEDIUMWordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-40763MEDIUMWordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-68999HIGHWordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-25398MEDIUMWordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-43977MEDIUMWordPress The Plus Addons for Elementor plugin <= 5.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0664MEDIUMRoyal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta BypassEPSS 0.3%CVE-2025-14277MEDIUMPrime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request ForgeryEPSS 0.3%CVE-2026-18405HIGHJeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.3%CVE-2024-53786MEDIUMWordPress Cowidgets – Elementor Addons plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1571MEDIUMExclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison WidgetsEPSS 0.3%CVE-2024-13734MEDIUMCard Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card WidgetEPSS 0.3%CVE-2025-32260MEDIUMWordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-32698MEDIUMWordPress Happy Addons for Elementor plugin <= 3.10.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%