Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-43267MEDIUMWordPress Mega Addons For Elementor plugin <= 1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34789MEDIUMWordPress Post Grid Elementor Addon plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34563MEDIUMWordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-13330MEDIUMAnimation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG UploadEPSS 0.3%CVE-2026-12869MEDIUMHeader Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template ImportEPSS 0.3%CVE-2026-14841MEDIUMKing Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid WidgetEPSS 0.3%CVE-2025-8874MEDIUMMaster Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBoxEPSS 0.3%CVE-2026-14870HIGHDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idEPSS 0.3%CVE-2026-40720HIGHWordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73361HIGHWordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-45437HIGHWordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32532HIGHWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57376HIGHWordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57718HIGHWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-39597HIGHWordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27376HIGHWordPress Claue - Clean, Minimal Elementor WooCommerce Theme theme <= 2.2.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-84820HIGHWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47476MEDIUMWordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2022-4102LOWRoyal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post DeletionEPSS 0.3%CVE-2025-24708HIGHWordPress WP Dynamics CRM plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%