Exposição de Elementor

Page builders, WordPress plugins
1.045
score de exposição
899.310
sites usam
0
em exploração
53
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.777 resultados
CVE-2024-2043MEDIUMEleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Missing Authorization to Sensitive Information ExposureEPSS 0.5%CVE-2021-4401HIGHStyle Kits <= 1.8.0 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2024-0834MEDIUMThe Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up EPSS 0.5%CVE-2024-3819MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - BannerEPSS 0.5%CVE-2024-1498MEDIUMHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack WidgetEPSS 0.5%CVE-2024-3199MEDIUMThe Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.5%CVE-2024-37090HIGHSQL Injection vulnerability in multiple StylemixThemes premium themesEPSS 0.5%CVE-2022-23180MEDIUMContact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings UpdateEPSS 0.5%CVE-2024-23523MEDIUMWordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerabilityEPSS 0.5%CVE-2026-56028CRITICALWordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-37092HIGHWordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2024-8979HIGHEssential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege EscalationEPSS 0.5%CVE-2024-10850MEDIUMRazorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-10316MEDIUMStratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor TemplatesEPSS 0.5%CVE-2023-38480MEDIUMWordPress Booster Elementor Addons plugin <= 1.4.9 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-33930CRITICALWordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerabilityEPSS 0.5%CVE-2024-37547MEDIUMWordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2023-6582MEDIUMElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information ExposureEPSS 0.5%CVE-2024-2091MEDIUMElementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-32682HIGHWordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerabilityEPSS 0.5%