Exposición de Elementor

Page builders, WordPress plugins
773
score de exposición
942.118
sitios usan
0
en explotación
47
críticos
Análisis Vexday

O plugin Elementor acumula 1.532 CVEs catalogadas, um volume expressivo que reflete sua ampla adoção no ecossistema WordPress e a consequente atenção de pesquisadores de segurança. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão esperado em componentes de construção de páginas com superfície de entrada extensa. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS mais alto observado chega a 0,92943 — valor atribuído à CVE-2022-1329 —, indicando alta probabilidade de exploração ativa para essa vulnerabilidade específica, o que justifica tratamento prioritário. O ritmo de 82 novas CVEs nos últimos 90 dias, somado a 46 de severidade crítica no histórico, reforça a necessidade de ciclos de atualização contínuos para ambientes que utilizam esse plugin.

CVEs

1593 resultados
CVE-2024-5147CRITICALWPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File InclusionEPSS 1.0%CVE-2023-0336MEDIUMOoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment DeletionEPSS 1.0%CVE-2024-5153CRITICALStartklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory DeletionEPSS 1.0%CVE-2023-0714HIGHMetform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File UploadEPSS 1.0%CVE-2024-5349HIGHLA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2026-4885CRITICALPiotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File UploadEPSS 1.0%CVE-2022-4703MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import DeletionEPSS 0.9%CVE-2026-9843HIGHDatabase for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST ValueEPSS 0.9%CVE-2024-5179HIGHCowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File InclusionEPSS 0.9%CVE-2023-4723MEDIUMElementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information ExposureEPSS 0.9%CVE-2026-4659HIGHUnlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path TraversalEPSS 0.9%CVE-2025-32672HIGHWordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion VulnerabilityEPSS 0.9%CVE-2024-2385HIGHElementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via WidgetsEPSS 0.9%CVE-2021-4331HIGHThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege EscalationEPSS 0.9%CVE-2021-25027—PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-13409HIGHPost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()EPSS 0.9%CVE-2024-5335CRITICALUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2024-3055HIGHUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL InjectionEPSS 0.8%CVE-2022-4700MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme ActivationEPSS 0.8%CVE-2026-1620HIGHLivemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template ParameterEPSS 0.8%