Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-7646MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-23543MEDIUMWordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-58251MEDIUMWordPress Sticky Header Effects for Elementor Plugin <= 2.1.2 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2024-37229MEDIUMWordPress Blogmentor – Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8445MEDIUMCountdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'EPSS 0.2%CVE-2026-4790MEDIUMPremium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' ParameterEPSS 0.2%CVE-2026-13406MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosureEPSS 0.2%CVE-2025-26761MEDIUMWordPress Easy Elementor Addons plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22811MEDIUMWordPress MT Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-26769MEDIUMWordPress Vertex Addons for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67468MEDIUMWordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-69363MEDIUMWordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-11220MEDIUMElementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text PathEPSS 0.2%CVE-2025-8146MEDIUMQi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text WidgetEPSS 0.2%CVE-2025-12537MEDIUMAddon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11820MEDIUMGraphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart WidgetsEPSS 0.2%CVE-2025-12830MEDIUMBetter Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider WidgetEPSS 0.2%CVE-2025-50038MEDIUMWordPress Anant Addons for Elementor plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-56221MEDIUMWordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-56268MEDIUMWordPress Post Grid Elementor Addon plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%