Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2026-24956CRITICALWordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerabilityEPSS 0.2%CVE-2025-8200MEDIUMMega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer WidgetEPSS 0.2%CVE-2025-12778MEDIUMUltimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information ExposureEPSS 0.2%CVE-2024-35782MEDIUMWordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-35713MEDIUMWordPress Testimonial Carousel For Elementor plugin <= 10.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-35703MEDIUMWordPress Sina Extension for Elementor plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-35702MEDIUMWordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-47303MEDIUMWordPress Elementor Addons by Livemesh plugin <= 8.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-35666MEDIUMWordPress Themesflat Addons For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6252MEDIUMQi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-8619MEDIUMOSM Map Widget for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URLEPSS 0.2%CVE-2025-8603MEDIUMUnlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-8564MEDIUMSKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.2%CVE-2025-8149MEDIUMaThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.2%CVE-2025-8150MEDIUMEvents Addon for Elementor <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown WidgetsEPSS 0.2%CVE-2025-8360MEDIUMLA-Studio Element Kit for Elementor <= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.2%CVE-2023-48762MEDIUMWordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-24584MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-22806MEDIUMWordPress Black Widgets For Elementor plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-34572MEDIUMWordPress Fancy Elementor Flipbox plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%