Exposure of Elementor

Page builders, WordPress plugins
895
exposure score
934,183
sites use
0
exploited
52
critical
Vexday analysis

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1,659 results
CVE-2025-46249MEDIUMWordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2026-24958MEDIUMWordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59592MEDIUMWordPress Make Column Clickable Elementor Plugin <= 1.6.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58205MEDIUMWordPress ElementInvader Addons for Elementor Plugin <= 1.3.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58208MEDIUMWordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin <= 6.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58195MEDIUMWordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-68532MEDIUMWordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-3075MEDIUMElementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13196MEDIUMElement Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widgetEPSS 0.2%CVE-2025-68500MEDIUMWordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2025-68086MEDIUMWordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64210MEDIUMWordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-68088MEDIUMWordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-68087MEDIUMWordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-68085MEDIUMWordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerabilityEPSS 0.2%CVE-2026-86809MEDIUMPersian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority BypassEPSS 0.2%CVE-2025-64355MEDIUMWordPress JetElements For Elementor plugin <= 2.7.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68559MEDIUMWordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62094MEDIUMWordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6229MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`EPSS 0.2%