What’s Vulnerable › Products

Elementor Website Builder vulnerabilities

53 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your Elementor Website Builder version is affected

Latest Elementor Website Builder vulnerabilities

• CVE-2026-81813 — Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass (CVSS 6.8)
• CVE-2026-81812 — Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload (CVSS 6.4)
• CVE-2026-11905 — Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters (CVSS 4.3)
• CVE-2026-62062 — WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
• CVE-2026-8825 — Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API (CVSS 4.9)
• CVE-2026-57619 — WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability (CVSS 6.5)
• CVE-2026-49782 — WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2026-6127 — Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (CVSS 6.4)
• CVE-2025-14732 — Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (CVSS 6.4)
• CVE-2026-1206 — Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3)
• CVE-2026-32445 — WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability (CVSS 2.7)
• CVE-2026-32352 — WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2024-50555 — WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-11220 — Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path (CVSS 6.4)
• CVE-2025-67588 — WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2025-8081 — Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import (CVSS 4.9)
• CVE-2025-4566 — Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget (CVSS 6.4)
• CVE-2025-3075 — Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-54444 — WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-13445 — Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-8494 — Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode (CVSS 6.5)
• CVE-2024-10453 — Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings (CVSS 5.4)
• CVE-2024-8236 — Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-6757 — Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function (CVSS 4.3)
• CVE-2024-5416 — Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets (CVSS 5.4)