Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2024-37554MEDIUMWordPress UltraAddons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51787MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51683MEDIUMWordPress Custom post type templates for Elementor plugin <= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51682MEDIUMWordPress HT Builder – WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51680MEDIUMWordPress Cresta Addons for Elementor plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51590MEDIUMWordPress Hoo Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51587MEDIUMWordPress Definitive Addons for Elementor plugin <= 1.5.16 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51584MEDIUMWordPress Marquee Elementor with Posts plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-49631MEDIUMWordPress Easy Addons for Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-7644MEDIUMPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-8214MEDIUMThe Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter WidgetEPSS 0.2%CVE-2025-8608MEDIUMMihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker PinsEPSS 0.2%CVE-2026-32462MEDIUMWordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-65534MEDIUMWordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53746MEDIUMWordPress Elementor Button Plus plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53743MEDIUMWordPress Countdown Timer for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53744MEDIUMWordPress Elementor Image Gallery plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53749MEDIUMWordPress Post Carousel Slider for Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-5092MEDIUMMultiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript LibraryEPSS 0.2%CVE-2025-11536MEDIUMElement Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request ForgeryEPSS 0.2%