Exposição de Elementor

Page builders, WordPress plugins
895
score de exposição
934.183
sites usam
0
em exploração
52
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.659 resultados
CVE-2024-47364MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47357MEDIUMWordPress Happy Addons for Elementor plugin <= 3.12.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50433MEDIUMWordPress Sky Addons for Elementor plugin <= 2.5.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53823MEDIUMWordPress The Plus Addons for Elementor plugin <= 5.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54212MEDIUMWordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38705MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47630MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2949MEDIUMXpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box WidgetEPSS 0.3%CVE-2025-1526MEDIUMDethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-11380MEDIUMJetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' SettingEPSS 0.3%CVE-2026-5243MEDIUMThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite WidgetEPSS 0.3%CVE-2026-3311MEDIUMThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress BarEPSS 0.3%CVE-2026-6565MEDIUMStyle Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit TitleEPSS 0.3%CVE-2026-3875MEDIUMBetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2026-2600MEDIUMElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab WidgetEPSS 0.3%CVE-2026-85575MEDIUMThe ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' ParameterEPSS 0.3%CVE-2024-34575MEDIUMWordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35688MEDIUMWordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43150MEDIUMWordPress Xpro Elementor Addons plugin <= 1.4.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47628MEDIUMWordPress LA-Studio Element Kit for Elementor plugin <= 1.3.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%