Login Request a demo
EL
Vendor
Elementor
10 products with CVEs on record
75
CVEs
0
On KEV
0
New 30D
Products
WB
Website Builder
Elementor
9.8
38 CVEs0 on KEV0 new
EW
Elementor Website Builder
Elementor
9.8
12 CVEs0 on KEV0 new
EP
Elementor Pro
Elementor
9.0
10 CVEs0 on KEV0 new
EP
Elementor Page Builder
Elementor
9.9
8 CVEs0 on KEV0 new
AL
Ally
Elementor
5.9
2 CVEs0 on KEV0 new
AL
Activity Log
Elementor
7.1
1 CVEs0 on KEV0 new
EL
Elementor
Elementor
8.8
1 CVEs0 on KEV0 new
HE
Hello Elementor
Elementor
4.3
1 CVEs0 on KEV0 new
IO
Image Optimizer by Elementor
Elementor
4.3
1 CVEs0 on KEV0 new
SM
Site Mailer
Elementor
7.2
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-62062
EW
Elementor Website Builder
Elementor
8.8
0%
Sep 25WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-84759
AL
Activity Log
Elementor
7.1
0%
Sep 2WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-32475
EP
Elementor Pro
Elementor
9.0
2%
Aug 19WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
CVE-2026-57619
EW
Elementor Website Builder
Elementor
6.5
0%
Jun 25WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability
CVE-2026-49782
EW
Elementor Website Builder
Elementor
5.4
0%
Jun 2WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability
CVE-2026-32445
EW
Elementor Website Builder
Elementor
2.7
0%
Mar 13WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability
CVE-2026-32352
EW
Elementor Website Builder
Elementor
6.5
0%
Mar 13WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability
CVE-2024-50555
EW
Elementor Website Builder
Elementor
6.5
0%
Feb 20WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-25387
IO
Image Optimizer by Elementor
Elementor
4.3
0%
Feb 19WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability
CVE-2026-25386
AL
Ally
Elementor
5.3
0%
Feb 19WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability
CVE-2025-67588
EW
Elementor Website Builder
Elementor
4.3
0%
Dec 9WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability
CVE-2025-8081
WB
Website Builder
Elementor
4.9
1%
Aug 12Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
CVE-2025-3075
WB
Website Builder
Elementor
5.4
0%
Jul 29Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2025-3076
EP
Elementor Page Builder
Elementor
5.4
0%
Jun 10Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2025-32640
AL
Ally
Elementor
5.9
0%
Apr 9WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability
CVE-2025-1319
SM
Site Mailer
Elementor
7.2
0%
Feb 28Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting
CVE-2024-54444
EW
Elementor Website Builder
Elementor
5.4
0%
Feb 25WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability
CVE-2024-13445
WB
Website Builder
Elementor
5.4
0%
Feb 20Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-8494
WB
Website Builder
Elementor
6.5
0%
Jan 30Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
CVE-2024-10453
WB
Website Builder
Elementor
5.4
0%
Dec 21Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings
CVE-2024-8236
WB
Website Builder
Elementor
5.4
0%
Nov 26Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-6757
WB
Website Builder
Elementor
4.3
0%
Oct 15Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
CVE-2024-5416
WB
Website Builder
Elementor
5.4
0%
Sep 11Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
CVE-2024-35656
EP
Elementor Pro
Elementor
6.1
0%
Jul 22WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2024-37437
EW
Elementor Website Builder
Elementor
5.4
0%
Jul 9WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability
CVE-2023-35050
EP
Elementor Pro
Elementor
5.4
0%
Jun 19WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability
CVE-2023-33922
EW
Elementor Website Builder
Elementor
4.3
0%
Jun 11WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability
CVE-2024-4619
WB
Website Builder
Elementor
5.4
0%
May 21Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
CVE-2024-24934
EW
Elementor Website Builder
Elementor
8.1
1%
May 17WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
CVE-2024-4107
WB
Website Builder
Elementor
5.4
0%
May 9Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
CVE-2023-47504
EW
Elementor Website Builder
Elementor
9.8
1%
Apr 24WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
CVE-2024-32681
EL
Elementor
Elementor
8.8
0%
Apr 22WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability
CVE-2024-31289
HE
Hello Elementor
Elementor
4.3
0%
Apr 12WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2024-2117
WB
Website Builder
Elementor
5.4
0%
Apr 9Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget
CVE-2024-1521
EP
Elementor Pro
Elementor
5.4
0%
Mar 27Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload
CVE-2024-2120
WB
Website Builder
Elementor
5.4
0%
Mar 27Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation
CVE-2024-2121
EP
Elementor Pro
Elementor
5.4
0%
Mar 27Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-2781
EP
Elementor Pro
Elementor
5.4
0%
Mar 27Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag
CVE-2024-1364
EP
Elementor Pro
Elementor
5.4
0%
Mar 27Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting
CVE-2023-48777
WB
Website Builder
Elementor
8.8
4%
Mar 26WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability
CVE-2024-23523
EP
Elementor Pro
Elementor
6.5
1%
Mar 16WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability
CVE-2024-0506
WB
Website Builder
Elementor
5.4
0%
Feb 20Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
CVE-2023-47505
WB
Website Builder
Elementor
5.4
25%
Nov 30WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)
CVE-2022-4953
WB
Website Builder
Elementor
6.1
3%
Aug 14Elementor < 3.5.5 - Iframe Injection
CVE-2023-3124
EP
Elementor Pro
Elementor
8.8
23%
Jun 7Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option
CVE-2020-36703
WB
Website Builder
Elementor
5.4
0%
Jun 7Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting
CVE-2023-0329
WB
Website Builder
Elementor
7.2
20%
May 30Elementor Website Builder < 3.12.2 - Admin+ SQLi
CVE-2022-29455
WB
Website Builder
Elementor
6.1
24%
Jun 13DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions
CVE-2022-1329
WB
Website Builder
Elementor
8.8
93%
Apr 19The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the…
CVE-2021-24891
WB
Website Builder
Elementor
6.1
29%
Nov 23The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site…
CVE-2021-24206
WB
Website Builder
Elementor
5.4
1%
Apr 5In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter
CVE-2021-24205
WB
Website Builder
Elementor
5.4
1%
Apr 5In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter
CVE-2021-24204
WB
Website Builder
Elementor
5.4
1%
Apr 5In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter
CVE-2021-24203
WB
Website Builder
Elementor
5.4
1%
Apr 5In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter
CVE-2021-24202
WB
Website Builder
Elementor
5.4
1%
Apr 5In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter
CVE-2021-24201
WB
Website Builder
Elementor
5.4
1%
Apr 5In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter
CVE-2020-36171
WB
Website Builder
Elementor
6.1
1%
Jan 6The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads
CVE-2020-26596
EP
Elementor Pro
Elementor
8.8
6%
Oct 7The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed…
CVE-2020-20406
EP
Elementor Page Builder
Elementor
5.4
1%
Sep 16A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions
CVE-2020-15020
WB
Website Builder
Elementor
5.4
1%
Aug 31An issue was discovered in the Elementor plugin through 2.9.13 for WordPress