Skip to content
Noroxi

Elementor Website Builder

elementor · plugin

Known security vulnerabilities for Elementor Website Builder. Find out in seconds which version runs on your site with WP Lens.

37 known vulnerabilities

2 critical · 6 with public exploit code · latest Sep 25, 2026

Vulnerabilities

  • CVE-2023-47504

    WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability

    Critical 9.8

  • CVE-2020-7109

    The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.

    Critical 9.8

  • CVE-2026-62062

    WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2023-48777

    WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

    High 8.8

  • CVE-2022-1329

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    High 8.8

  • CVE-2017-18596

    The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.

    High 8.8

  • CVE-2024-24934

    WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability

    High 8.1

  • CVE-2026-57619

    WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability

    Medium 6.5

  • CVE-2026-32352

    WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-50555

    WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-6127

    Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

    Medium 6.4

  • CVE-2025-14732

    Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

    Medium 6.4

  • CVE-2025-11220

    Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path

    Medium 6.4

  • CVE-2025-4566

    Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

    Medium 6.4

  • CVE-2022-29455

    WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2020-36171

    The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.

    Medium 6.1

  • CVE-2026-49782

    WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2025-3075

    Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-54444

    WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-13445

    Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-10453

    Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings

    Medium 5.4

  • CVE-2024-8236

    Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-5416

    Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple

    Medium 5.4

  • CVE-2024-37437

    WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability

    Medium 5.4

  • CVE-2024-4619

    Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-2117

    Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget

    Medium 5.4

  • CVE-2024-0506

    Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt

    Medium 5.4

  • CVE-2023-47505

    WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2020-20406

    A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions

    Medium 5.4

  • CVE-2020-15020

    An issue was discovered in the Elementor plugin through 2.9.13 for WordPress.

    Medium 5.4

  • CVE-2020-8426

    The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page.

    Medium 5.4

  • CVE-2025-8081

    Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

    Medium 4.9

  • CVE-2026-1206

    Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

    Medium 4.3

  • CVE-2025-67588

    WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2024-6757

    Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function

    Medium 4.3

  • CVE-2023-33922

    WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2026-32445

    WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability

    Low 2.7

← Back to directory