Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-32505MEDIUMWordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5290MEDIUMBorderless – Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-2225MEDIUMResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'EPSS 0.3%CVE-2024-7147MEDIUMJetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-18100MEDIUMMetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget SettingEPSS 0.3%CVE-2024-33634MEDIUMWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-12141MEDIUMPremium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' ParameterEPSS 0.3%CVE-2024-29920MEDIUMWordPress Move Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32572MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32557MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.6.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1802MEDIUMHT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2024-49654HIGHWordPress Extra Privacy for Elementor plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14635MEDIUMHappy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSEPSS 0.3%CVE-2024-24840MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerabilityEPSS 0.3%CVE-2024-24844HIGHWordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerabilityEPSS 0.3%CVE-2025-31889MEDIUMWordPress Extensions for Elementor plugin <= 2.0.40 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30925MEDIUMWordPress The Pack Elementor addons plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28147MEDIUMWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-11363MEDIUMRoyal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File UploadEPSS 0.3%CVE-2025-32641CRITICALWordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerabilityEPSS 0.3%