Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-58796MEDIUMWordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-22468MEDIUMWordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-22812MEDIUMWordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22818MEDIUMWordPress S3Player plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22333MEDIUMWordPress Piotnet Addons For Elementor plugin <= 2.4.31 - Cross-Site Scripting vulnerabilityEPSS 0.2%CVE-2025-22323MEDIUMWordPress Image Hover Effects for Elementor plugin <= 1.0.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22321MEDIUMWordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-52425MEDIUMWordPress Drozd – Addons for Elementor plugin <= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-22136MEDIUMWordPress Droit Elementor Addons Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2024-50555MEDIUMWordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13141MEDIUMHT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute InjectionEPSS 0.2%CVE-2026-0633LOWMetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie ValueEPSS 0.2%CVE-2025-64352LOWWordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-8462MEDIUMRT Easy Builder <= 2.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-15650MEDIUMRT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block AttributeEPSS 0.2%CVE-2025-5292MEDIUMElement Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-48288MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58254MEDIUMWordPress StylePress for Elementor Plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58017MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57999MEDIUMWordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%