Exposición de Elementor

Page builders, WordPress plugins
895
score de exposición
934.183
sitios usan
0
en explotación
52
críticos
Análisis Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1659 resultados
CVE-2024-6459CRITICALNews Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFIEPSS 1.0%CVE-2024-6297CRITICALSeveral WordPress.org Plugins <= Various Versions - Injected BackdoorEPSS 1.0%CVE-2024-5147CRITICALWPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File InclusionEPSS 1.0%CVE-2023-0336MEDIUMOoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment DeletionEPSS 1.0%CVE-2024-5153CRITICALStartklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory DeletionEPSS 1.0%CVE-2026-15338HIGHLA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget SettingEPSS 1.0%CVE-2023-0714HIGHMetform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File UploadEPSS 1.0%CVE-2024-5349HIGHLA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2026-4885CRITICALPiotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File UploadEPSS 1.0%CVE-2022-4703MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import DeletionEPSS 0.9%CVE-2024-5179HIGHCowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File InclusionEPSS 0.9%CVE-2025-32672HIGHWordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion VulnerabilityEPSS 0.9%CVE-2023-4723MEDIUMElementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information ExposureEPSS 0.9%CVE-2026-23693CRITICALElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST EndpointEPSS 0.9%CVE-2026-18438HIGHTemplately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename MismatchEPSS 0.9%CVE-2026-4659HIGHUnlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path TraversalEPSS 0.9%CVE-2024-2385HIGHElementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via WidgetsEPSS 0.9%CVE-2021-4331HIGHThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege EscalationEPSS 0.9%CVE-2021-25027—PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-13409HIGHPost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()EPSS 0.9%