Elementor vulnerabilities
25 CVEs and advisories name Elementor as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120850WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109883WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109884WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62062WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-84759WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32475WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
- CVE-2026-57619WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability
- CVE-2026-49782WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability
- CVE-2026-32445WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability
- CVE-2026-32352WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-50555WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25387WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability
- CVE-2026-25386WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability
- CVE-2025-67588WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability
- CVE-2025-32640WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability
- CVE-2024-54444WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-35656WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37437WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability
- CVE-2023-35050WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability
- CVE-2023-33922WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability
- CVE-2024-24934WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
- CVE-2023-47504WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
- CVE-2024-31289WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-23523WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability
- CVE-2022-29455WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability