npm element-plus vulnerabilities

Latest npm element-plus CVEs

Newest publication first

1. CVE-2025-57665 Element Plus Link component (el-link) implements insufficient input validation for the href attribute

   Published 2025-09-09

   Medium·CVSS 6.4 EPSS 0.25%

   Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor element...

2. CVE-2022-27103 element-plus vulnerable to cross-site scripting (XSS) via el-table-column

   Published 2022-04-25

   Medium·CVSS 6.1 EPSS 0.89%

   element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.