Exposición de Elementor

Page builders, WordPress plugins
895
score de exposición
934.183
sitios usan
0
en explotación
52
críticos
Análisis Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1659 resultados
CVE-2024-5332MEDIUMExclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card WidgetEPSS 0.3%CVE-2024-5583MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget SettingsEPSS 0.3%CVE-2024-5086MEDIUMEssential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel WidgetEPSS 0.3%CVE-2024-2254MEDIUMRT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site ScriptingEPSS 0.3%CVE-2024-5612MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal WidgetEPSS 0.3%CVE-2024-2784MEDIUMThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover CardEPSS 0.3%CVE-2024-5818MEDIUMRoyal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider WidgetEPSS 0.3%CVE-2024-9867MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map WidgetEPSS 0.3%CVE-2024-9868MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age GateEPSS 0.3%CVE-2024-32785HIGHWordPress The Pack Elementor addons plugin <= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityEPSS 0.3%CVE-2024-47629MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35709MEDIUMWordPress The Plus Addons for Elementor plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1870MEDIUMThim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course DisclosureEPSS 0.3%CVE-2023-0495MEDIUMHT Slider For Elementor < 1.4.0 - Arbitrary Plugin Activation via CSRFEPSS 0.3%CVE-2022-4103MEDIUMRoyal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post CreationEPSS 0.3%CVE-2024-47632MEDIUMWordPress DethemeKit For Elementor plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47392MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47390MEDIUMWordPress Jeg Elementor Kit plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49702MEDIUMWordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47366MEDIUMWordPress Elementor Addon Elements plugin <= 1.13.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%