Elementor Website Builder Pro

Software Type	Plugin
Software Slug	elementor-pro
Software Status	Active
Software Author	https://elementor.com/
Software Website	elementor.com
Software Record Last Updated	May 2, 2024

13 Vulnerabilities

Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload

9.9

CVE-2020-13126

May 6, 2020

Researcher: Chloe Chamberland

Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option

8.8

CVE-2023-3124

Mar 28, 2023

Researcher: Jerome Bruandet

Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget

7.2

CVE-2020-26596

Oct 6, 2020

Researchers:

Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4

CVE-2024-4107

May 2, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-1364

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag

6.4

CVE-2024-2781

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload

6.4

CVE-2024-1521

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Pro <= 3.13.0 - Missing Authorization

6.3

CVE-2023-35050

Jun 20, 2023

Researcher: Rafie Muhammad

Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting

6.1

CVE-2024-35656

Jun 28, 2024

Researcher: Michael

Elementor Pro <= 2.0.9 - Cross-Site Scripting

6.1

CVE-2018-18379

Oct 26, 2018

Researcher: Christopher Vella

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVE-2024-2121

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation

5.4

CVE-2024-2120

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure

4.3

CVE-2024-23523

Feb 26, 2024

Researcher: Dynamic.ooo Team

Title	Status	CVE ID	CVSS	Researchers	Date
Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload	Patched	CVE-2020-13126	9.9	Chloe Chamberland	May 6, 2020
Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option	Patched	CVE-2023-3124	8.8	Jerome Bruandet	March 28, 2023
Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget	Patched	CVE-2020-26596	7.2		October 6, 2020
Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Patched	CVE-2024-4107	6.4	wesley (wcraft)	May 2, 2024
Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-1364	6.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag	Patched	CVE-2024-2781	6.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload	Patched	CVE-2024-1521	6.4	wesley (wcraft)	March 26, 2024
Elementor Pro <= 3.13.0 - Missing Authorization	Patched	CVE-2023-35050	6.3	Rafie Muhammad	June 20, 2023
Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting	Patched	CVE-2024-35656	6.1	Michael	June 28, 2024
Elementor Pro <= 2.0.9 - Cross-Site Scripting	Patched	CVE-2018-18379	6.1	Christopher Vella	October 26, 2018
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-2121	5.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation	Patched	CVE-2024-2120	5.4	wesley (wcraft)	March 26, 2024
Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure	Patched	CVE-2024-23523	4.3	Dynamic.ooo Team	February 26, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation