Elemntor vulnerabilities

Products

• Elementor Website Builder – More Than Just A Page Builder 17
• Ally – Web Accessibility & Usability 2

Newest

• elemntor elementor website builder – more than just a page builder Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters CVE-2026-11905 4.3 MediumOctober 15, 2026
• elemntor hello plus Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site CVE-2026-5727 5.4 MediumOctober 10, 2026
• elemntor image optimizer – compress images and convert to webp or avif Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection CVE-2026-5821 8.1 HighJuly 2, 2026
• elemntor temporary login Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover CVE-2026-7567 Public exploit 9.8 CriticalMay 1, 2026
• elemntor elementor website builder – more than just a page builder Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API CVE-2026-6127 6.4 MediumMay 1, 2026
• elemntor elementor website builder – more than just a page builder Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API CVE-2025-14732 6.4 MediumApril 8, 2026
• elemntor elementor website builder – more than just a page builder Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template CVE-2026-1206 4.3 MediumMarch 26, 2026
• elemntor ally – web accessibility & usability Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path CVE-2026-2413 Public exploit 7.5 HighMarch 11, 2026
• elemntor elementor website builder – more than just a page builder Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path CVE-2025-11220 6.4 MediumDecember 16, 2025
• elemntor ally – web accessibility & usability Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update CVE-2025-10700 4.3 MediumOctober 16, 2025
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import CVE-2025-8081 Public exploit 4.9 MediumAugust 12, 2025
• elemntor elementor website builder – more than just a page builder Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget CVE-2025-4566 6.4 MediumJuly 29, 2025
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-3075 6.4 MediumJuly 29, 2025
• elementor site mailer, elemntor site mailer – smtp replacement, email api deliverability & email log +1 more Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting CVE-2025-1319 7.2 HighFebruary 28, 2025
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-13445 6.4 MediumFebruary 20, 2025
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings CVE-2024-10453 6.4 MediumDecember 21, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-8236 6.4 MediumNovember 26, 2024
• elemntor activity log – monitor & record user changes, pojo activity log +1 more Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context CVE-2024-10788 7.2 HighNovember 21, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function CVE-2024-6757 4.3 MediumOctober 15, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets CVE-2024-5416 5.4 MediumSeptember 11, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVE-2024-4619 6.4 MediumMay 21, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget CVE-2024-2117 6.4 MediumApril 9, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt CVE-2024-0506 6.4 MediumFebruary 20, 2024
• elementor website builder, elemntor elementor website builder – more than just a page builder +1 more Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting CVE-2020-36703 6.4 MediumJune 7, 2023
• elementor website builder, elemntor elementor website builder +1 more Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution CVE-2022-1329 Public exploit EPSS 92.7% 8.8 HighApril 19, 2022