# cve.now: Elementor

The newest entries naming Elementor as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120850](https://cve.now/CVE-2026-120850.md): WordPress Elementor Website Builder plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-109883](https://cve.now/CVE-2026-109883.md): WordPress Elementor Website Builder plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-109884](https://cve.now/CVE-2026-109884.md): WordPress Elementor Website Builder plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-62062](https://cve.now/CVE-2026-62062.md): WordPress Elementor Website Builder plugin \<= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- [CVE-2026-84759](https://cve.now/CVE-2026-84759.md): WordPress Activity Log plugin \<= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1)
- [CVE-2026-32475](https://cve.now/CVE-2026-32475.md): WordPress Elementor Pro plugin \<= 4.2.1 - Arbitrary File Upload vulnerability (CVSS 9.0)
- [CVE-2026-57619](https://cve.now/CVE-2026-57619.md): WordPress Elementor Website Builder plugin \<= 4.1.3 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-49782](https://cve.now/CVE-2026-49782.md): WordPress Elementor Website Builder plugin \<= 4.1.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-32445](https://cve.now/CVE-2026-32445.md): WordPress Elementor Website Builder plugin \<= 3.35.5 - Broken Access Control vulnerability (CVSS 2.7)
- [CVE-2026-32352](https://cve.now/CVE-2026-32352.md): WordPress Elementor Website Builder plugin \<= 3.35.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-50555](https://cve.now/CVE-2024-50555.md): WordPress Elementor Website Builder plugin \<= 3.29.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-25387](https://cve.now/CVE-2026-25387.md): WordPress Image Optimizer by Elementor plugin \<= 1.7.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-25386](https://cve.now/CVE-2026-25386.md): WordPress Ally plugin \<= 4.0.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-67588](https://cve.now/CVE-2025-67588.md): WordPress Elementor Website Builder plugin \<= 3.33.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-32640](https://cve.now/CVE-2025-32640.md): WordPress One Click Accessibility plugin \<= 3.1.0 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-54444](https://cve.now/CVE-2024-54444.md): WordPress Elementor plugin \<= 3.25.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-35656](https://cve.now/CVE-2024-35656.md): WordPress Elementor Pro \<= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-37437](https://cve.now/CVE-2024-37437.md): WordPress Elementor Website Builder plugin \<= 3.22.1 - Arbitrary SVG File Download vulnerability (CVSS 5.5)
- [CVE-2023-35050](https://cve.now/CVE-2023-35050.md): WordPress Elementor Pro plugin \<= 3.13.0 - Auth. Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-33922](https://cve.now/CVE-2023-33922.md): WordPress Elementor plugin \<= 3.13.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-24934](https://cve.now/CVE-2024-24934.md): WordPress Elementor plugin \<= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability (CVSS 8.5)
- [CVE-2023-47504](https://cve.now/CVE-2023-47504.md): WordPress Elementor plugin \<= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability (CVSS 6.5)
- [CVE-2024-31289](https://cve.now/CVE-2024-31289.md): WordPress Hello Elementor theme \<= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-23523](https://cve.now/CVE-2024-23523.md): WordPress Elementor Pro plugin \<= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability (CVSS 6.5)
- [CVE-2022-29455](https://cve.now/CVE-2022-29455.md): WordPress Elementor plugin \<= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/elementor
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.