Elementor Website Builder – more than just a page builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Elementor Website Builder – more than just a page builder

Information

Software Type Plugin
Software Slug elementor (view on wordpress.org)
Software Status Active
Software Author elemntor
Software Website elementor.com
Software Downloads 859,495,594
Software Active Installs 10,000,000
Software Record Last Updated July 10, 2026

Showing 1-20 of 52 Vulnerabilities

Submit a Vulnerability
Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2026-57619
Jun 25, 2026
Researcher: Steven Julian
Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization
4.3
CVE-2026-49782
Jun 2, 2026
Researcher: Bonds
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
6.4
CVE-2026-6127
Apr 30, 2026
Researcher: Jonah Burgess (CryptoCat)
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
6.4
CVE-2025-14732
Apr 7, 2026
Researcher: andrea bocchetti
Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
4.3
CVE-2026-1206
Mar 25, 2026
Researcher: shark3y
Elementor Website Builder <= 3.35.5 - Missing Authorization
4.3
CVE-2026-32445
Mar 7, 2026
Researcher: davidfdzmorilla
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-32352
Feb 13, 2026
Researcher: ickogz
Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path
6.4
CVE-2025-11220
Dec 15, 2025
Researcher: Asaf Mozes
Elementor Website Builder <= 3.33.0 - Missing Authorization
4.3
CVE-2025-67588
Nov 25, 2025
Researcher: Bonds
Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
4.9
CVE-2025-8081
Aug 11, 2025
Researcher: mikemyers
Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget
6.4
CVE-2025-4566
Jul 28, 2025
Researcher: Asaf Mozes
Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-3075
Jul 28, 2025
Researcher: Tonn
Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-50555
Jun 19, 2025
Researcher: Bonds
Elementor Website Builder <= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-54444
Feb 24, 2025
Researcher: stealthcopter
Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-13445
Feb 19, 2025
Researcher: zer0gh0st
Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings
6.4
CVE-2024-10453
Dec 20, 2024
Researcher: zer0gh0st
Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-8236
Nov 25, 2024
Researcher: wesley (wcraft)
Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
4.3
CVE-2024-6757
Oct 14, 2024
Researcher: stealthcopter
Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
5.4
CVE-2024-5416
Sep 10, 2024
Researcher: wesley (wcraft)
Elementor Website Builder <= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download
6.4
CVE-2024-37437
Jun 28, 2024
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure Patched CVE-2026-57619 4.3 Steven Julian June 25, 2026
Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization Patched CVE-2026-49782 4.3 Bonds June 2, 2026
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Patched CVE-2026-6127 6.4 Jonah Burgess (CryptoCat) April 30, 2026
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Patched CVE-2025-14732 6.4 andrea bocchetti April 7, 2026
Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template Patched CVE-2026-1206 4.3 shark3y March 25, 2026
Elementor Website Builder <= 3.35.5 - Missing Authorization Patched CVE-2026-32445 4.3 davidfdzmorilla March 7, 2026
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-32352 6.4 ickogz February 13, 2026
Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path Patched CVE-2025-11220 6.4 Asaf Mozes December 15, 2025
Elementor Website Builder <= 3.33.0 - Missing Authorization Patched CVE-2025-67588 4.3 Bonds November 25, 2025
Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import Patched CVE-2025-8081 4.9 mikemyers August 11, 2025
Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget Patched CVE-2025-4566 6.4 Asaf Mozes July 28, 2025
Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-3075 6.4 Tonn July 28, 2025
Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-50555 6.4 Bonds June 19, 2025
Elementor Website Builder <= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-54444 6.4 stealthcopter February 24, 2025
Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-13445 6.4 zer0gh0st February 19, 2025
Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings Patched CVE-2024-10453 6.4 zer0gh0st December 20, 2024
Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-8236 6.4 wesley (wcraft) November 25, 2024
Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function Patched CVE-2024-6757 4.3 stealthcopter October 14, 2024
Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets Patched CVE-2024-5416 5.4 wesley (wcraft) September 10, 2024
Elementor Website Builder <= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download Patched CVE-2024-37437 6.4 stealthcopter June 28, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation