Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-14434MEDIUMUltimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content DisclosureEPSS 0.3%CVE-2025-0661MEDIUMDethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post DisclosureEPSS 0.3%CVE-2024-30525MEDIUMWordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-66116HIGHWordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2024-12328MEDIUMMAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVGEPSS 0.3%CVE-2024-3887MEDIUMRoyal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder WidgetEPSS 0.3%CVE-2026-32527MEDIUMWordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-5340MEDIUMMusic Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url ParameterEPSS 0.3%CVE-2026-25320MEDIUMWordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-56226HIGHWordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0898MEDIUMXpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVGEPSS 0.3%CVE-2025-9082MEDIUMWPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4944MEDIUMLA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps WidgetsEPSS 0.3%CVE-2025-6550MEDIUMThe Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-24605MEDIUMWordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-3831MEDIUMDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via ShortcodeEPSS 0.3%CVE-2024-56227MEDIUMWordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-62041HIGHWordPress TheGem (Elementor) theme <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22758MEDIUMWordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1456MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%