Exposición de Elementor

Page builders, WordPress plugins
895
score de exposición
934.183
sitios usan
0
en explotación
52
críticos
Análisis Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1659 resultados
CVE-2024-1242MEDIUMPremium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-13378HIGHForm Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form FieldEPSS 0.4%CVE-2023-41236HIGHWordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-2399MEDIUMPremium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-6843MEDIUMeasy.jobs < 2.4.7 - Subscriber+ Arbitrary Settings UpdateEPSS 0.4%CVE-2024-33539MEDIUMWordPress WPZOOM Addons for Elementor plugin <= 1.1.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2280MEDIUMBetter Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linksEPSS 0.4%CVE-2023-41804HIGHWordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2024-3333MEDIUMEssential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL AttributeEPSS 0.4%CVE-2024-4858MEDIUMTestimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting UpdateEPSS 0.4%CVE-2024-5757MEDIUMElementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title WidgetEPSS 0.4%CVE-2024-4619MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5787MEDIUMPowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects WidgetEPSS 0.4%CVE-2024-4479MEDIUMJeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion WidgetsEPSS 0.4%CVE-2025-32135MEDIUMWordPress Split Test For Elementor plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9530MEDIUMQi Addons For Elementor <= 1.8.0 - Sensitive Information ExposureEPSS 0.4%CVE-2024-51812MEDIUMWordPress Pro Addons For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5662MEDIUMUltimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) WidgetEPSS 0.4%CVE-2024-4482MEDIUMThe Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%CVE-2024-3718MEDIUMThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip BoxEPSS 0.4%