Exposición de Elementor

Page builders, WordPress plugins
773
score de exposición
942.118
sitios usan
0
en explotación
47
críticos
Análisis Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1593 resultados
CVE-2022-1329HIGHElementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code ExecutionEPSS 92.7%CVE-2023-5360—Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File UploadEPSS 81.7%CVE-2023-32243CRITICALWordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege EscalationEPSS 75.5%CVE-2022-0349—NotificationX < 2.3.9 - Unauthenticated Blind SQL InjectionEPSS 34.4%CVE-2023-0084HIGHMetform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 28.6%CVE-2023-47505MEDIUMWordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)EPSS 25.3%CVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 25.1%CVE-2022-29455MEDIUMWordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 23.2%CVE-2023-3124HIGHElementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_optionEPSS 22.7%CVE-2023-0329HIGHElementor Website Builder < 3.12.2 - Admin+ SQLiEPSS 19.7%CVE-2021-24175—The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication BypassEPSS 14.5%CVE-2025-13065HIGHStarter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload BypassEPSS 13.1%CVE-2025-8489CRITICALKing Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege EscalationEPSS 9.3%CVE-2022-1442HIGHMetform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information DisclosureEPSS 8.8%CVE-2024-9935HIGHPDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File DownloadEPSS 7.4%CVE-2026-7665MEDIUMEssential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX HandlerEPSS 7.2%CVE-2023-48777CRITICALWordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerabilityEPSS 4.1%CVE-2025-8100MEDIUMElement Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker ContentEPSS 3.3%CVE-2022-0683MEDIUMEssential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site ScriptingEPSS 3.2%CVE-2022-4953—Elementor < 3.5.5 - Iframe InjectionEPSS 2.9%