Exposición de Elementor

Page builders, WordPress plugins
886
score de exposición
934.183
sitios usan
0
en explotación
52
críticos
Análisis Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1656 resultados
CVE-2023-48759HIGHWordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerabilityEPSS 0.4%CVE-2024-54316MEDIUMWordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54314MEDIUMWordPress Primary Addon for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54315MEDIUMWordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-0586MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site ScritpingEPSS 0.4%CVE-2024-1996MEDIUMPremium Addons for Elementor PRO <= 2.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linkEPSS 0.4%CVE-2024-0334MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom AttributesEPSS 0.4%CVE-2024-0585MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URlEPSS 0.4%CVE-2024-43293MEDIUMWordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.3.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-32681MEDIUMWordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-2517MEDIUMMetform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setupEPSS 0.4%CVE-2026-8825MEDIUMElementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST APIEPSS 0.4%CVE-2025-49444CRITICALWordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2024-35660MEDIUMWordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerabilityEPSS 0.4%CVE-2024-3547MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-6455MEDIUMElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content FunctionEPSS 0.4%CVE-2024-37269MEDIUMWordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-84088MEDIUMXpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle WidgetEPSS 0.4%CVE-2021-4445MEDIUMPremium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option UpdateEPSS 0.4%CVE-2024-29101MEDIUMWordPress Jeg Elementor Kit plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%