Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-54037MEDIUMWordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-13404MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_initEPSS 0.2%CVE-2024-24843HIGHWordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2024-13642MEDIUMStratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot WidgetEPSS 0.2%CVE-2025-1441MEDIUMRoyal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-2284MEDIUMNews Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data LossEPSS 0.2%CVE-2025-64244MEDIUMWordPress Restrict Elementor Widgets, Columns and Sections plugin <= 1.12 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-1458MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-14149MEDIUMXpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box linkEPSS 0.2%CVE-2025-13997MEDIUMKing Addons for Elementor <= 51.1.49 - Unauthenticated API Keys DisclosureEPSS 0.2%CVE-2025-26745MEDIUMWordPress RS Elements Elementor Addon plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-6628MEDIUMEleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request ForgeryEPSS 0.2%CVE-2026-13407MEDIUMRoyal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification EmailsEPSS 0.2%CVE-2025-12965MEDIUMMagical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion WidgetEPSS 0.2%CVE-2025-1261MEDIUMHT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown WidgetEPSS 0.2%CVE-2025-8779MEDIUMAll-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown WidgetsEPSS 0.2%CVE-2025-8687MEDIUMEnter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison WidgetsEPSS 0.2%CVE-2025-8199MEDIUMMarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee WidgetEPSS 0.2%CVE-2025-48354MEDIUMWordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53199MEDIUMWordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%