Elemntor vulnerabilities
25 CVEs and advisories name Elemntor as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-11905Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
- CVE-2026-5727Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
- CVE-2026-5821Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
- CVE-2026-7567Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
- CVE-2026-6127Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
- CVE-2025-14732Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
- CVE-2026-1206Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
- CVE-2026-2413Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
- CVE-2025-11220Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path
- CVE-2025-10700Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2025-8081Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
- CVE-2025-4566Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget
- CVE-2025-3075Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-1319Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-13445Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10453Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings
- CVE-2024-8236Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10788Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context
- CVE-2024-6757Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
- CVE-2024-5416Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
- CVE-2024-4619Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- CVE-2024-2117Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget
- CVE-2024-0506Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
- CVE-2020-36703Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting
- CVE-2022-1329Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution