Exposição de Elementor

Page builders, WordPress plugins
1.045
score de exposição
899.310
sites usam
0
em exploração
53
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.777 resultados
CVE-2024-37462HIGHWordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2023-0708MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcodeEPSS 0.6%CVE-2023-3709MEDIUMRoyal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key DisclosureEPSS 0.6%CVE-2024-1467MEDIUMStarter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request ForgeryEPSS 0.6%CVE-2023-1169MEDIUMOoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image UploadEPSS 0.6%CVE-2024-49251HIGHWordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2023-50884MEDIUMWordPress LA-Studio Element Kit for Elementor plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-3743MEDIUMElementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-51665MEDIUMWordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.6%CVE-2025-24569HIGHWordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.5 - Arbitrary File Read vulnerabilityEPSS 0.6%CVE-2023-47178HIGHWordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-34384MEDIUMWordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-43932MEDIUMWordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-33635HIGHWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerabilityEPSS 0.6%CVE-2026-17585MEDIUMRoyal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' ParameterEPSS 0.6%CVE-2024-3936MEDIUMThe Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing AuthorizationEPSS 0.6%CVE-2024-50453HIGHWordPress The Pack Elementor addons plugin <= 2.0.9 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2021-24265—Rife Elementor Extensions & Templates < 1.1.6 - Contributor+ Stored XSSEPSS 0.6%CVE-2026-18561HIGHUnlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL InjectionEPSS 0.6%CVE-2026-17580MEDIUMAdvanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST EndpointsEPSS 0.6%