CVEs we hold for Elementor

Records whose assigning authority named Elementor as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-8825Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST APIUnknown Elementor Website Builder

CVE-2026-84759WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityElementor Activity Log

CVE-2026-57619WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerabilityElementor Website Builder

CVE-2026-49782WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerabilityElementor Website Builder

CVE-2026-32475WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerabilityElementor Pro

CVE-2026-32445WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerabilityElementor Website Builder

CVE-2026-32352WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder

CVE-2026-25387WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerabilityElementor

CVE-2026-25386WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerabilityElementor Ally

CVE-2025-67588WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerabilityElementor Website Builder

CVE-2025-32640WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerabilityElementor Ally

CVE-2024-54444WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder

CVE-2024-50555WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder

CVE-2024-37437WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerabilityElementor Website Builder

CVE-2024-35656WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerabilityElementor Pro

CVE-2024-31289WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityElementor

CVE-2024-24934WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerabilityElementor Website Builder

CVE-2024-23523WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerabilityElementor Pro

CVE-2023-48777WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerabilityElementor.com Elementor Website Builder

CVE-2023-47505WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)Elementor.com Elementor

CVE-2023-47504WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerabilityElementor Website Builder

CVE-2023-35050WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerabilityElementor Pro

CVE-2023-33922WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerabilityElementor Website Builder

CVE-2023-2324Elementor Forms Google Sheet Connector < 1.0.7 - Reflected XSSUnknown gsheetconnector-for-elementor-forms-pro

CVE-2023-0329Elementor Website Builder < 3.12.2 - Admin+ SQLiUnknown Elementor Website Builder

CVE-2022-4953Elementor < 3.5.5 - Iframe InjectionUnknown Elementor Website Builder

CVE-2022-29455WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerabilityElementor Website Builder (WordPress plugin)

CVE-2021-24891Elementor < 3.4.8 - DOM Cross-Site-ScriptingUnknown Elementor Website Builder

CVE-2021-24259Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSSUnknown Elementor Addon Elements

CVE-2021-24256Elementor - Header, Footer & Blocks Template < 1.5.8 - Contributor+ Stored XSSUnknown Elementor – Header, Footer & Blocks Template

CVE-2021-24206Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetUnknown Elementor Website Builder

CVE-2021-24205Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetUnknown Elementor Website Builder

CVE-2021-24204Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetUnknown Elementor Website Builder

CVE-2021-24203Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetUnknown Elementor Website Builder

CVE-2021-24202Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading WidgetUnknown Elementor Website Builder

CVE-2021-24201Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementUnknown Elementor Website Builder

36 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.