Exposição de Elementor

Page builders, WordPress plugins
1.045
score de exposição
899.310
sites usam
0
em exploração
53
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.777 resultados
CVE-2024-10782MEDIUMTheme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post DisclosureEPSS 0.5%CVE-2026-14870HIGHDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idEPSS 0.5%CVE-2024-3074MEDIUMElementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-0506MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_altEPSS 0.5%CVE-2024-8515MEDIUMThemesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-12140MEDIUMElementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content DisclosureEPSS 0.5%CVE-2025-57955MEDIUMWordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control VulnerabilityEPSS 0.5%CVE-2024-2117MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path WidgetEPSS 0.5%CVE-2024-2786MEDIUMHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tagEPSS 0.5%CVE-2021-4447HIGHEssential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege EscalationEPSS 0.5%CVE-2024-2665MEDIUMPremium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.5%CVE-2023-2324—Elementor Forms Google Sheet Connector < 1.0.7 - Reflected XSSEPSS 0.5%CVE-2024-0766MEDIUMEnvo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_requestEPSS 0.5%CVE-2024-30533HIGHWordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-1172MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AccordionEPSS 0.5%CVE-2025-8151MEDIUMHT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File ActionsEPSS 0.5%CVE-2024-32786MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerabilityEPSS 0.5%CVE-2024-4779HIGHUnlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]EPSS 0.5%CVE-2024-4780MEDIUMImage Hover Effects – Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link ParameterEPSS 0.5%CVE-2025-8867MEDIUMGraphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%