Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-63033MEDIUMWordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-38730MEDIUMWordPress Magical Addons For Elementor plugin <= 1.1.41 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2025-39448MEDIUMWordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58793MEDIUMWordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48295MEDIUMWordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53989MEDIUMWordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53982MEDIUMWordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-33632MEDIUMWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-64211MEDIUMWordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24947MEDIUMWordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-9029MEDIUMWDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission FunctionEPSS 0.2%CVE-2024-0513MEDIUMRoyal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlistEPSS 0.2%CVE-2024-0515MEDIUMRoyal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compareEPSS 0.2%CVE-2025-48132MEDIUMWordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-30987MEDIUMWordPress JetBlocks For Elementor plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-11603MEDIUMProduct Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' ParameterEPSS 0.2%CVE-2026-25028MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-39546MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2025-30863MEDIUMWordPress Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-22518MEDIUMWordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%