# cve.now: Elemntor

The newest entries naming Elemntor as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-11905](https://cve.now/CVE-2026-11905.md): Elementor Website Builder \<= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is\_public' and 'keys\_conversion\_map' Parameters (CVSS 4.3)
- [CVE-2026-5727](https://cve.now/CVE-2026-5727.md): Hello Plus \<= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello\_plus\_set\_as\_entire\_site (CVSS 5.4)
- [CVE-2026-5821](https://cve.now/CVE-2026-5821.md): Image Optimizer \<= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection (CVSS 8.1)
- [CVE-2026-7567](https://cve.now/CVE-2026-7567.md): Temporary Login \<= 1.0.0 - Authentication Bypass to Account Takeover (CVSS 9.8)
- [CVE-2026-6127](https://cve.now/CVE-2026-6127.md): Elementor Website Builder \<= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (CVSS 6.4)
- [CVE-2025-14732](https://cve.now/CVE-2025-14732.md): Elementor Website Builder \<= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (CVSS 6.4)
- [CVE-2026-1206](https://cve.now/CVE-2026-1206.md): Elementor Website Builder \<= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3)
- [CVE-2026-2413](https://cve.now/CVE-2026-2413.md): Ally – Web Accessibility & Usability \<= 4.0.3 - Unauthenticated SQL Injection via URL Path (CVSS 7.5)
- [CVE-2025-11220](https://cve.now/CVE-2025-11220.md): Elementor \<= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path (CVSS 6.4)
- [CVE-2025-10700](https://cve.now/CVE-2025-10700.md): Ally - Web Accessibility & Usability \<= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3)
- [CVE-2025-8081](https://cve.now/CVE-2025-8081.md): Elementor \<= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import (CVSS 4.9)
- [CVE-2025-4566](https://cve.now/CVE-2025-4566.md): Elementor \<= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget (CVSS 6.4)
- [CVE-2025-3075](https://cve.now/CVE-2025-3075.md): Elementor \<= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-1319](https://cve.now/CVE-2025-1319.md): Site Mailer \<= 1.2.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-13445](https://cve.now/CVE-2024-13445.md): Elementor Website Builder – More Than Just a Page Builder \<= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-10453](https://cve.now/CVE-2024-10453.md): Elementor Website Builder – More than Just a Page Builder \<= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings (CVSS 6.4)
- [CVE-2024-8236](https://cve.now/CVE-2024-8236.md): Elementor Website Builder – More than Just a Page Builder \<= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-10788](https://cve.now/CVE-2024-10788.md): Activity Log – Monitor & Record User Changes \<= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context (CVSS 7.2)
- [CVE-2024-6757](https://cve.now/CVE-2024-6757.md): Elementor \<= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get\_image\_alt Function (CVSS 4.3)
- [CVE-2024-5416](https://cve.now/CVE-2024-5416.md): Elementor Website Builder – More than Just a Page Builder \<= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets (CVSS 5.4)
- [CVE-2024-4619](https://cve.now/CVE-2024-4619.md): Elementor Website Builder – More than Just a Page Builder \<= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2117](https://cve.now/CVE-2024-2117.md): Elementor Website Builder – More than Just a Page Builder \<= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget (CVSS 6.4)
- [CVE-2024-0506](https://cve.now/CVE-2024-0506.md): Elementor Website Builder – More than Just a Page Builder \<= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get\_image\_alt (CVSS 6.4)
- [CVE-2020-36703](https://cve.now/CVE-2020-36703.md): Elementor Website Builder \<= 2.9.7 - Authenticated Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-1329](https://cve.now/CVE-2022-1329.md): Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/elemntor
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.