Elementor Website Builder – more than just a page builder

Уязвимости

• CVE-2020-7109без авторизации

  The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.

  Критич. 9.8

• CVE-2023-47504нужен вход≤ 3.16.4

  WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability

  Критич. 9.8

• CVE-2026-62062без авторизации · нужен клик≤ 4.3.1

  WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

  Высокий 8.8

• CVE-2023-48777нужен вход≤ 3.18.1

  WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

  Высокий 8.8

• CVE-2022-1329нужен вход

  Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

  Высокий 8.8

• CVE-2017-18596нужен вход

  The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.

  Высокий 8.8

• CVE-2024-24934нужен вход≤ 3.19.0

  WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability

  Высокий 8.1

• CVE-2026-32352нужен вход≤ 3.35.5

  WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2024-50555нужен вход≤ 3.29.0

  WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-57619участник+≤ 4.1.3

  WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability

  Средний 6.5

• CVE-2026-6127участник+≤ 4.0.4

  Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

  Средний 6.4

• CVE-2025-14732участник+≤ 3.35.5

  Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

  Средний 6.4

• CVE-2025-11220участник+≤ 3.33.3

  Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path

  Средний 6.4

• CVE-2025-4566участник+≤ 3.30.2

  Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

  Средний 6.4

• CVE-2022-29455без авторизации · нужен клик≤ 3.5.5

  WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2020-36171без авторизации · нужен клик

  The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.

  Средний 6.1

• CVE-2026-49782нужен вход≤ 4.1.0

  WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability

  Средний 5.4

• CVE-2024-54444нужен вход≤ 3.25.10

  WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-37437нужен вход≤ 3.22.1

  WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability

  Средний 5.4

• CVE-2023-47505нужен вход≤ 3.16.4

  WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

  Средний 5.4

• CVE-2020-20406нужен вход

  A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions

  Средний 5.4

• CVE-2020-15020нужен вход

  An issue was discovered in the Elementor plugin through 2.9.13 for WordPress.

  Средний 5.4

• CVE-2020-8426нужен вход

  The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page.

  Средний 5.4

• CVE-2025-3075участник+≤ 3.29.0

  Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-13445участник+≤ 3.27.4

  Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-10453участник+≤ 3.25.9

  Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings

  Средний 5.4

• CVE-2024-8236участник+≤ 3.25.7

  Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-5416участник+≤ 3.23.4

  Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple

  Средний 5.4

• CVE-2024-4619участник+≤ 3.21.5

  Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-2117участник+≤ 3.20.2

  Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget

  Средний 5.4

• CVE-2024-0506участник+≤ 3.18.3

  Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt

  Средний 5.4

• CVE-2025-8081админ≤ 3.30.2

  Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

  Средний 4.9

• CVE-2025-67588нужен вход≤ 3.33.0

  WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

  Средний 4.3

• CVE-2023-33922нужен вход≤ 3.13.2

  WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability

  Средний 4.3

• CVE-2026-1206участник+≤ 3.35.7

  Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

  Средний 4.3

• CVE-2024-6757участник+≤ 3.24.5

  Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function

  Средний 4.3

• CVE-2026-32445высокие права≤ 3.35.5

  WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability

  Низкий 2.7