Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-1455MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46259MEDIUMWordPress The Plus Addons for Elementor - Pro Plugin < 6.3.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13445MEDIUMElementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-10266MEDIUMPremium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box WidgetEPSS 0.3%CVE-2024-9888MEDIUMElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-0433MEDIUMMaster Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2025-31529MEDIUMWordPress Slider Path for Elementor plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-0484MEDIUMContact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRFEPSS 0.3%CVE-2024-44026MEDIUMWordPress Charity Addon for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47396MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47332MEDIUMWordPress Sky Addons for Elementor plugin <= 2.5.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47329MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32783MEDIUMWordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49262HIGHWordPress Sina Extension for Elementor plugin <= 3.6.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-31636HIGHWordPress WP Post Modules for Elementor plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1641MEDIUMWow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File SettingEPSS 0.3%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%CVE-2024-34570MEDIUMWordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-66142MEDIUMWordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-66136MEDIUMWordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.3%