Elementor Website Builder – more than just a page builder

Güvenlik açıkları

• CVE-2020-7109kimlik doğrulamasız

  The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.

  Kritik 9.8

• CVE-2023-47504giriş gerekir≤ 3.16.4

  WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability

  Kritik 9.8

• CVE-2026-62062kimlik doğrulamasız · tıklama gerekir≤ 4.3.1

  WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

  Yüksek 8.8

• CVE-2023-48777giriş gerekir≤ 3.18.1

  WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

  Yüksek 8.8

• CVE-2022-1329giriş gerekir

  Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

  Yüksek 8.8

• CVE-2017-18596giriş gerekir

  The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.

  Yüksek 8.8

• CVE-2024-24934giriş gerekir≤ 3.19.0

  WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability

  Yüksek 8.1

• CVE-2026-32352giriş gerekir≤ 3.35.5

  WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2024-50555giriş gerekir≤ 3.29.0

  WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-57619katılımcı+≤ 4.1.3

  WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability

  Orta 6.5

• CVE-2026-6127katılımcı+≤ 4.0.4

  Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

  Orta 6.4

• CVE-2025-14732katılımcı+≤ 3.35.5

  Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

  Orta 6.4

• CVE-2025-11220katılımcı+≤ 3.33.3

  Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path

  Orta 6.4

• CVE-2025-4566katılımcı+≤ 3.30.2

  Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

  Orta 6.4

• CVE-2022-29455kimlik doğrulamasız · tıklama gerekir≤ 3.5.5

  WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2020-36171kimlik doğrulamasız · tıklama gerekir

  The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.

  Orta 6.1

• CVE-2026-49782giriş gerekir≤ 4.1.0

  WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability

  Orta 5.4

• CVE-2024-54444giriş gerekir≤ 3.25.10

  WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability

  Orta 5.4

• CVE-2024-37437giriş gerekir≤ 3.22.1

  WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability

  Orta 5.4

• CVE-2023-47505giriş gerekir≤ 3.16.4

  WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

  Orta 5.4

• CVE-2020-20406giriş gerekir

  A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions

  Orta 5.4

• CVE-2020-15020giriş gerekir

  An issue was discovered in the Elementor plugin through 2.9.13 for WordPress.

  Orta 5.4

• CVE-2020-8426giriş gerekir

  The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page.

  Orta 5.4

• CVE-2025-3075katılımcı+≤ 3.29.0

  Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Orta 5.4

• CVE-2024-13445katılımcı+≤ 3.27.4

  Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Orta 5.4

• CVE-2024-10453katılımcı+≤ 3.25.9

  Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings

  Orta 5.4

• CVE-2024-8236katılımcı+≤ 3.25.7

  Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Orta 5.4

• CVE-2024-5416katılımcı+≤ 3.23.4

  Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple

  Orta 5.4

• CVE-2024-4619katılımcı+≤ 3.21.5

  Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

  Orta 5.4

• CVE-2024-2117katılımcı+≤ 3.20.2

  Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget

  Orta 5.4

• CVE-2024-0506katılımcı+≤ 3.18.3

  Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt

  Orta 5.4

• CVE-2025-8081yönetici≤ 3.30.2

  Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

  Orta 4.9

• CVE-2025-67588giriş gerekir≤ 3.33.0

  WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

  Orta 4.3

• CVE-2023-33922giriş gerekir≤ 3.13.2

  WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability

  Orta 4.3

• CVE-2026-1206katılımcı+≤ 3.35.7

  Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

  Orta 4.3

• CVE-2024-6757katılımcı+≤ 3.24.5

  Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function

  Orta 4.3

• CVE-2026-32445yüksek yetki≤ 3.35.5

  WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability

  Düşük 2.7