Plugin icon

Elementor Website Builder – More Than Just a Page Builder

elementor

Vulnerabilities:

42

Last Updated:

January 7, 2026

Active Installs:

10000000

Published
Title
Fixed in
CVSS
Published
2025-12-15
Title
Elementor < 3.33.4 - Contributor+ Stored DOM-Based XSS via Text Path
Fixed in
Fixed in 3.33.4
CVSS
5.9 (medium)
Published
2025-11-25
Title
Elementor Website Builder < 3.33.1 - Missing Authorization
Fixed in
Fixed in 3.33.1
CVSS
4.3 (medium)
Published
2025-08-11
Title
Elementor < 3.30.3 - Admin+ Arbitrary File Read via Image Import
Fixed in
Fixed in 3.30.3
CVSS
4.9 (medium)
Published
2025-07-28
Title
Elementor < 3.29.1 - Contributor+ Stored XSS
Fixed in
Fixed in 3.29.1
CVSS
5.9 (medium)
Published
2025-07-28
Title
Elementor < 3.30.3 - Contributor+ Stored XSS via Text Path Widget
Fixed in
Fixed in 3.30.3
CVSS
5.9 (medium)
Published
2025-06-19
Title
Elementor Website Builder < 3.29.1 - Contributor+ Stored XSS
Fixed in
Fixed in 3.29.1
CVSS
5.9 (medium)
Published
2025-02-24
Title
Elementor Website Builder < 3.25.11 - Contributor+ Stored XSS
Fixed in
Fixed in 3.25.11
CVSS
5.9 (medium)
Published
2025-02-19
Title
Elementor Website Builder < 3.27.5 - Contributor+ Stored XSS
Fixed in
Fixed in 3.27.5
CVSS
5.9 (medium)
Published
2024-12-20
Title
Elementor Website Builder < 3.25.10 - Contributor+ Stored XSS via Typography Settings
Fixed in
Fixed in 3.25.10
CVSS
5.9 (medium)
Published
2024-11-25
Title
Elementor Website Builder < 3.25.8 - Contributor+ Stored XSS
Fixed in
Fixed in 3.25.8
CVSS
5.9 (medium)
Published
2024-10-14
Title
Elementor < 3.24.6 - Contributor+ Information Exposure via get_image_alt
Fixed in
Fixed in 3.24.6
CVSS
2.7 (low)
Published
2024-09-10
Title
Elementor Website Builder – More than Just a Page Builder < 3.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
Fixed in
Fixed in 3.24.0
CVSS
5.4 (medium)
Published
2024-06-28
Title
Elementor Website Builder < 3.22.2 - Contributor+ Arbitrary SVG Download
Fixed in
Fixed in 3.22.2
CVSS
6.4 (medium)
Published
2024-05-20
Title
Elementor Website Builder < 3.21.6 - Contributor+ DOM Stored XSS
Fixed in
Fixed in 3.21.6
CVSS
5.9 (medium)
Published
2024-03-26
Title
Elementor Website Builder < 3.20.3 - Contributor+ DOM Stored XSS
Fixed in
Fixed in 3.20.3
CVSS
5.9 (medium)
Published
2024-02-07
Title
Elementor Website Builder – More than Just a Page Builder < 3.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
Fixed in
Fixed in 3.19.0
CVSS
6.4 (medium)
Published
2024-02-07
Title
Elementor < 3.19.1 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
Fixed in
Fixed in 3.19.1
CVSS
8.8 (high)
Published
2023-12-06
Title
Elementor < 3.18.2 - Contributor+ Arbitrary File Upload to RCE via Template Import
Fixed in
Fixed in 3.18.2
CVSS
7.2 (high)
Published
2023-11-08
Title
Elementor Website Builder < 3.16.5 - Missing Authorization to Arbitrary Attachment Read
Fixed in
Fixed in 3.16.5
CVSS
6.5 (medium)
Published
2023-11-08
Title
Elementor Website Builder < 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
Fixed in
Fixed in 3.16.5
CVSS
6.4 (medium)
Published
2023-07-19
Title
Elementor < 3.5.5 - Iframe Injection
Fixed in
Fixed in 3.5.5
CVSS
4.3 (medium)
Published
2023-05-12
Title
Elementor Website Builder < 3.13.2 - Missing Authorization
Fixed in
Fixed in 3.13.2
CVSS
5.4 (medium)
Published
2023-05-02
Title
Elementor Website Builder < 3.12.2 - Admin+ SQLi
Fixed in
Fixed in 3.12.2
CVSS
5.5 (medium)
Published
2022-06-13
Title
Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting
Fixed in
Fixed in 3.5.6
CVSS
6.1 (medium)
Published
2022-04-13
Title
Elementor 3.6.0-3.6.2 - Subscriber+ Arbitrary File Upload
Fixed in
Fixed in 3.6.3
CVSS
9.9 (critical)
Published
2021-03-24
Title
Elementor < 3.4.8 - DOM Cross-Site-Scripting
Fixed in
Fixed in 3.4.8
CVSS
6.1 (medium)
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
Fixed in
Fixed in 3.1.4
CVSS
6.4 (medium)
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
Fixed in
Fixed in 3.1.4
CVSS
6.4 (medium)
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget
Fixed in
Fixed in 3.1.4
CVSS
6.4 (medium)
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
Fixed in
Fixed in 3.1.4
CVSS
6.4 (medium)
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
Fixed in
Fixed in 3.1.4
CVSS
6.4 (medium)
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
Fixed in
Fixed in 3.1.4
CVSS
6.4 (medium)
Published
2021-01-06
Title
Elementor < 3.0.14 - SVG Upload Allowed by Default
Fixed in
Fixed in 3.0.14
CVSS
5.5 (medium)
Published
2020-07-21
Title
Elementor < 2.9.14 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.9.14
CVSS
6.6 (medium)
Published
2020-06-05
Title
Elementor Page Builder < 2.9.10 - Authenticated Stored XSS
Fixed in
Fixed in 2.9.10
CVSS
8.0 (high)
Published
2020-05-06
Title
Elementor < 2.9.8 - SVG Sanitizer Bypass leading to Authenticated Stored XSS
Fixed in
Fixed in 2.9.8
CVSS
5.5 (medium)
Published
2020-03-31
Title
Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation
Fixed in
Fixed in 2.9.6
CVSS
4.3 (medium)
Published
2020-01-29
Title
Elementor Page Builder < 2.8.5 - Authenticated Reflected XSS
Fixed in
Fixed in 2.8.5
CVSS
5.4 (medium)
Published
2020-01-29
Title
Elementor Page Builder < 2.7.7 - Authenticated Stored XSS
Fixed in
Fixed in 2.7.7
CVSS
5.4 (medium)
Published
2020-01-19
Title
Elementor Page Builder < 2.8.4 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.8.4
CVSS
4.8 (medium)
Published
2020-01-14
Title
Elementor < 2.7.5 - Authenticated Arbitrary File Upload
Fixed in
Fixed in 2.7.5
CVSS
9.1 (critical)
Published
2017-11-27
Title
Elementor Page Builder < 1.8.0 - Authenticated Unrestricted Editing
Fixed in
Fixed in 1.8.0
CVSS
8.8 (high)