Exposição de Elementor

Page builders, WordPress plugins
895
score de exposição
934.183
sites usam
0
em exploração
52
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.659 resultados
CVE-2024-5335CRITICALUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2023-41955HIGHWordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerabilityEPSS 0.8%CVE-2024-3055HIGHUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL InjectionEPSS 0.8%CVE-2026-1620HIGHLivemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template ParameterEPSS 0.8%CVE-2022-4700MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme ActivationEPSS 0.8%CVE-2024-5348HIGHElements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget AttributesEPSS 0.8%CVE-2021-4332MEDIUMThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File ReadEPSS 0.8%CVE-2022-0327—Master Addons for Elementor < 1.8.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-4704MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template ImportEPSS 0.8%CVE-2022-4702MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin DeactivationEPSS 0.8%CVE-2024-13808HIGHXpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code ExecutionEPSS 0.8%CVE-2024-3018HIGHEssential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpasswordEPSS 0.8%CVE-2023-37390HIGHWordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object InjectionEPSS 0.8%CVE-2026-18351CRITICALDrag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' ParameterEPSS 0.8%CVE-2025-14155MEDIUMPremium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'EPSS 0.8%CVE-2023-31090CRITICALWordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerabilityEPSS 0.8%CVE-2024-4875MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options UpdateEPSS 0.8%CVE-2024-12272HIGHWP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File InclusionEPSS 0.8%CVE-2023-31212HIGHWordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL InjectionEPSS 0.8%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%