Elementor Website Builder vulnerabilities | LiveThreat CVE Feed

Product

Elementor Website Builder

by Elementor · last CVE Sep 25, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities12 In the news0 Timeline

Severity mix

Critical 1High 2Medium 8Low 1

Severity

All severities12 Critical1 High2 Medium8 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Elementor Website Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-47504	9.8	1%	Apr 24	WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability Affected: through 3.16.4
CVE-2026-62062	8.8	0%	Sep 25	WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 4.3.1
CVE-2024-24934	8.1	1%	May 17	WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability Affected: through 3.19.0
CVE-2026-57619	6.5	0%	Jun 25	WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability Affected: through 4.1.3
CVE-2026-32352	6.5	0%	Mar 13	WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability Affected: through 3.35.5
CVE-2024-50555	6.5	0%	Feb 20	WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability Affected: through 3.29.0
CVE-2026-49782	5.4	0%	Jun 2	WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability Affected: through 4.1.0
CVE-2024-54444	5.4	0%	Feb 25	WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability Affected: through 3.25.10
CVE-2024-37437	5.4	0%	Jul 9	WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability Affected: through 3.22.1
CVE-2025-67588	4.3	0%	Dec 9	WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability Affected: through 3.33.0
CVE-2023-33922	4.3	0%	Jun 11	WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability Affected: through 3.13.2
CVE-2026-32445	2.7	0%	Mar 13	WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability Affected: through 3.35.5