Exposição de Elementor

Page builders, WordPress plugins
895
score de exposição
934.183
sites usam
0
em exploração
52
críticos
Análise Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1.659 resultados
CVE-2023-1843MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Missing AuthorizationEPSS 0.6%CVE-2026-75921HIGHMaster Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP ExtractionEPSS 0.6%CVE-2023-0443MEDIUMAnyWhere Elementor < 1.2.8 - Freemius API Key DisclosureEPSS 0.6%CVE-2024-5455HIGHThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File InclusionEPSS 0.6%CVE-2022-2116—Elementor Contact Form DB < 1.8.0 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-6214HIGHHT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_productsEPSS 0.6%CVE-2024-0326MEDIUMPremium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link WrapperEPSS 0.6%CVE-2025-10896HIGHMultiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin UploadEPSS 0.6%CVE-2024-37089CRITICALWordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerabilityEPSS 0.6%CVE-2021-42360HIGHStarter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSSEPSS 0.6%CVE-2024-37419HIGHWordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2023-35046MEDIUMWordPress Dynamic Visibility for Elementor plugin <= 5.0.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-4709MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit ImportEPSS 0.6%CVE-2022-4708MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions ModificationEPSS 0.6%CVE-2022-4705MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template ActivationEPSS 0.6%CVE-2024-0826MEDIUMQi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-4156MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-4471HIGH140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object InjectionEPSS 0.6%CVE-2024-4574MEDIUMGraphina – Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.6%CVE-2023-0692MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcodeEPSS 0.6%