Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-6171MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam BypassEPSS 0.2%CVE-2024-34817MEDIUMWordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-58816LOWWordPress Product Carousel Slider for Elementor Plugin <= 2.1.3 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-22500MEDIUMWordPress Alpha Price Table For Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22648MEDIUMWordPress Blog, Posts and Category Filter for Elementor plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-50447MEDIUMWordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-39361MEDIUMWordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51675MEDIUMWordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13644MEDIUMDethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery WidgetEPSS 0.2%CVE-2024-13547MEDIUMaThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-57995MEDIUMWordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-7046MEDIUMPortfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSEPSS 0.2%CVE-2026-1512MEDIUMEssential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box WidgetEPSS 0.2%CVE-2024-51685MEDIUMWordPress Accordion title for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66154MEDIUMWordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66156MEDIUMWordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66157MEDIUMWordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66158MEDIUMWordPress Gmaper for Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66159MEDIUMWordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66155MEDIUMWordPress Questionar for Elementor plugin <= 1.1.7 - Broken Access Control vulnerabilityEPSS 0.2%