Elementor
20 CVEs across 10 Elementor products. Browse Elementor vulnerabilities, severities, and proof-of-concept exploits.
Elementor products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57619 | Medium | 6.5 | 2026-06-25 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. |
CVE-2026-49782 | Medium | 5.4 | 2026-06-02 | Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2026-32445 | Low | 2.7 | 2026-03-13 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-32352 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-… |
CVE-2024-50555 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stor… |
CVE-2026-25387 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-25386 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-67588 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-8081 | Medium | 4.9 | 2025-08-12 | The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function d… |
CVE-2025-3075 | Medium | 6.4 | 2025-07-29 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-ele… |
CVE-2025-3076 | Medium | 6.4 | 2025-06-10 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and… |
CVE-2025-32640 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This… |
CVE-2025-1319 | High | 7.2 | 2025-02-28 | The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t… |
CVE-2024-54444 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stor… |
CVE-2024-13445 | Medium | 6.4 | 2025-02-20 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap… |
CVE-2024-8494 | Medium | 4.3 | 2025-01-30 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'e… |
CVE-2024-10453 | Medium | 6.4 | 2024-12-21 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Set… |
CVE-2024-8236 | Medium | 6.4 | 2024-11-26 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the… |
CVE-2024-6757 | Medium | 4.3 | 2024-10-15 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and inclu… |
CVE-2024-5416 | Medium | 5.4 | 2024-09-11 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multip… |
CVE-2024-35656 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This… |
CVE-2024-37437 | Medium | 5.5 | 2024-07-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue… |
CVE-2023-35050 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Elementor Elementor Pro.This issue affects Elementor Pro: from n/a through 3.13.0. |
CVE-2023-33922 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in Elementor Elementor Website Builder.This issue affects Elementor Website Builder: from n/a through 3.13.2. |
CVE-2024-4619 | Medium | 6.4 | 2024-05-21 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘hover_animat… |
CVE-2024-24934 | High | 8.5 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Inp… |
CVE-2024-4107 | Medium | 6.4 | 2024-05-14 | The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters… |
CVE-2023-47504 | Medium | 6.5 | 2024-04-24 | Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2024-31289 | Medium | 4.3 | 2024-04-12 | Cross-Site Request Forgery (CSRF) vulnerability in Elementor Hello Elementor.This issue affects Hello Elementor: from n/a through 3.0.0. |
CVE-2024-2117 | Medium | 6.4 | 2024-04-09 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Path Widget in… |
CVE-2024-2781 | Medium | 6.4 | 2024-03-27 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and… |
CVE-2024-2121 | Medium | 5.4 | 2024-03-27 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up t… |
CVE-2024-2120 | Medium | 5.4 | 2024-03-27 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up… |
CVE-2024-1521 | Medium | 6.4 | 2024-03-27 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versio… |
CVE-2024-1364 | Medium | 6.4 | 2024-03-27 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including… |
CVE-2023-48777 | Critical | 9.9 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3… |
CVE-2024-23523 | Medium | 6.5 | 2024-03-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2. |
CVE-2024-0506 | Medium | 6.4 | 2024-02-29 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $instance[alt] param… |
CVE-2023-47505 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor.Com Elementor allows Cross-Site Scripting (XSS)… |
CVE-2022-4953 | Medium | 6.1 | 2023-08-14 | The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inje… |
CVE-2023-3124 | High | 8.8 | 2023-06-07 | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in… |
CVE-2020-36703 | Medium | 6.4 | 2023-06-07 | The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 Th… |
CVE-2023-0329 | High | 7.2 | 2023-05-30 | The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using i… |
CVE-2022-29455 | Medium | 4.7 | 2022-06-13 | DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. |
CVE-2022-1329 | High | 8.8 | 2022-04-19 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/c… |
CVE-2021-24891 | Medium | 6.1 | 2021-11-23 | The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM… |
CVE-2021-24206 | Medium | 5.4 | 2021-04-05 | In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Althoug… |
CVE-2021-24205 | Medium | 5.4 | 2021-04-05 | In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although… |
CVE-2021-24204 | Medium | 5.4 | 2021-04-05 | In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Alt… |
CVE-2021-24203 | Medium | 5.4 | 2021-04-05 | In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the… |
CVE-2021-24202 | Medium | 5.4 | 2021-04-05 | In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although t… |
CVE-2021-24201 | Medium | 5.4 | 2021-04-05 | In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the… |
CVE-2020-36171 | Medium | 6.1 | 2021-01-06 | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. |
CVE-2020-26596 | High | 8.8 | 2020-10-07 | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Ed… |
CVE-2020-20406 | Medium | 5.4 | 2020-09-16 | A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by i… |
CVE-2020-15020 | Medium | 5.4 | 2020-08-31 | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field. |
CVE-2020-20634 | Medium | 6.5 | 2020-08-21 | Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins… |
CVE-2020-13865 | Medium | 5.4 | 2020-06-05 | The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in s… |
CVE-2020-13864 | Medium | 5.4 | 2020-06-05 | The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored X… |
CVE-2020-13126 | Critical | 9.9 | 2020-05-17 | An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An att… |
CVE-2020-7055 | Critical | 9.9 | 2020-04-22 | An issue was discovered in Elementor 2.7.4. Arbitrary file upload is possible in the Elementor Import Templates function, allowing an attacker to execute code… |
CVE-2020-8426 | Medium | 5.4 | 2020-01-28 | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeti… |
CVE-2020-7109 | Critical | 9.8 | 2020-01-22 | The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template. |
CVE-2018-18379 | Medium | 6.1 | 2019-10-07 | The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. |
CVE-2017-18596 | High | 8.8 | 2019-09-10 | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. |