Advisories · Technology

Elementor Website Builder.

Every CVE that names Elementor Website Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120850 CVE record

CVSS 6.5 Medium

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 7 Nov 2026
CVE-2026-109883 CVE record

CVSS 7.1 High

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2026
CVE-2026-109884 CVE record

CVSS 7.1 High

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 6 Nov 2026
CVE-2026-81813 CVE record

CVSS 6.8 Medium

Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 21 Oct 2026
CVE-2026-81812 CVE record

CVSS 6.4 Medium

Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 21 Oct 2026
CVE-2026-62062 CVE record

CVSS 8.8 High

WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Elementor Website Builder
- Cross-site request forgery (CSRF)
Not analysed yet 25 Sept 2026
CVE-2026-8825 CVE record

CVSS 4.9 Medium

Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
- Elementor Website Builder
- Information disclosure
Not analysed yet 20 Jul 2026
CVE-2026-57619 CVE record

CVSS 6.5 Medium

WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability
- Elementor Website Builder
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-49782 CVE record

CVSS 5.4 Medium

WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability
- Elementor Website Builder
- Broken access control
Not analysed yet 2 Jun 2026
CVE-2026-32445 CVE record

CVSS 2.7 Low

WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability
- Elementor Website Builder
- Broken access control
Not analysed yet 13 Mar 2026
CVE-2026-32352 CVE record

CVSS 6.5 Medium

WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 13 Mar 2026
CVE-2024-50555 CVE record

CVSS 6.5 Medium

WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2026
CVE-2025-67588 CVE record

CVSS 4.3 Medium

WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability
- Elementor Website Builder
- Broken access control
Not analysed yet 9 Dec 2025
CVE-2024-54444 CVE record

CVSS 6.5 Medium

WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 25 Feb 2025
CVE-2024-37437 CVE record

CVSS 5.5 Medium

WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2023-33922 CVE record

CVSS 4.3 Medium

WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability
- Elementor Website Builder
- Broken access control
Not analysed yet 11 Jun 2024
CVE-2024-24934 CVE record

CVSS 8.5 High

WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
- Elementor Website Builder
- Path traversal
Not analysed yet 17 May 2024
CVE-2023-47504 CVE record

CVSS 6.5 Medium

WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
- Elementor Website Builder
- Authentication bypass
Not analysed yet 24 Apr 2024
CVE-2022-4953 CVE record

Elementor < 3.5.5 - Iframe Injection
- Elementor Website Builder
Not analysed yet 14 Aug 2023
CVE-2023-0329 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Elementor Website Builder < 3.12.2 - Admin+ SQLi
- Elementor Website Builder
Not analysed yet 30 May 2023
CVE-2021-24891 CVE record

Elementor < 3.4.8 - DOM Cross-Site-Scripting
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 23 Nov 2021
CVE-2021-24206 CVE record

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2021
CVE-2021-24205 CVE record

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2021
CVE-2021-24204 CVE record

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2021
CVE-2021-24203 CVE record

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2021
CVE-2021-24202 CVE record

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2021
CVE-2021-24201 CVE record

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
- Elementor Website Builder
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2021