Exposição de Elementor

Page builders, WordPress plugins
1.045
score de exposição
899.310
sites usam
0
em exploração
53
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.777 resultados
CVE-2025-32158HIGHWordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerabilityEPSS 0.8%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%CVE-2024-0376MEDIUMPremium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link WidgetEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-24203—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetEPSS 0.7%CVE-2021-24206—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetEPSS 0.7%CVE-2021-24202—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading WidgetEPSS 0.7%CVE-2023-31212HIGHWordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL InjectionEPSS 0.7%CVE-2024-13353HIGHResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File InclusionEPSS 0.7%CVE-2022-4710MEDIUMRoyal Elementor Addons <= 1.3.59 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-4106MEDIUMHT Mega < 3.0.7 – Unauthenticated PII DisclosureEPSS 0.7%CVE-2024-29792HIGHWordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2023-0688MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcodeEPSS 0.7%CVE-2024-52496HIGHWordPress Absolute Addons For Elementor plugin <= 1.0.14 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2023-39157CRITICALWordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)EPSS 0.7%CVE-2024-24934HIGHWordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerabilityEPSS 0.7%CVE-2026-9018HIGHEasy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' ParameterEPSS 0.7%CVE-2024-52499HIGHWordPress Pricing table addon for elementor plugin <= 1.0.0 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2023-0721HIGHMetform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV InjectionEPSS 0.7%