VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Elementor Website Builder – more than just a page builder security & vulnerabilities

elementor— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 61 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
61Known vulnerabilities
  • Critical0
  • High8
  • Medium53
  • Low0
Vulnerabilities per year
2017: 1 vulnerability1172019: 1 vulnerability1192020: 10 vulnerabilities10202021: 7 vulnerabilities7212022: 2 vulnerabilities2222023: 7 vulnerabilities7232024: 9 vulnerabilities9242025: 8 vulnerabilities8252026: 16 vulnerabilities1626

All Elementor Website Builder – more than just a page builder vulnerabilities

Elementor Website Builder – more than just a page builder vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<4.3.6Update to 4.3.6
CVE-2026-104718
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.3.5Update to 4.3.6
CVE-2026-120850
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.3.5Update to 4.3.6
CVE-2026-109883
Medium6.1Reflected Cross-Site Scripting
≤4.3.5Update to 4.3.6
CVE-2026-109884
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.3.4Update to 4.3.5
CVE-2026-81813
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤4.3.4Update to 4.3.5
CVE-2026-81812
Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
≤4.2.3Update to 4.2.4
CVE-2026-11905
High8.84.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation
4.3.0 – 4.3.1Update to 4.3.2
CVE-2026-62062
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
≤4.1.3Update to 4.1.4
CVE-2026-8825
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
≤4.1.3Update to 4.1.4
CVE-2026-57619
Medium4.3Missing Authorization
≤4.1.0Update to 4.1.1
CVE-2026-49782
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
≤4.0.4Update to 4.0.5
CVE-2026-6127
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
≤3.35.5Update to 3.35.6
CVE-2025-14732
Medium4.3Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
≤3.35.7Update to 3.35.8
CVE-2026-1206
Medium4.3Missing Authorization
≤3.35.5Update to 3.35.6
CVE-2026-32445
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.35.5Update to 3.35.6
CVE-2026-32352
Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path
≤3.33.3Update to 3.33.4
CVE-2025-11220
Medium4.3Missing Authorization
≤3.33.0Update to 3.33.1
CVE-2025-67588
Medium4.9Authenticated (Administrator+) Arbitrary File Read via Image Import
≤3.30.2Update to 3.30.3
CVE-2025-8081
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.29.0Update to 3.29.1
CVE-2025-3075
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget
≤3.30.2Update to 3.30.3
CVE-2025-4566
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.29.0Update to 3.29.1
CVE-2024-50555
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.25.10Update to 3.25.11
CVE-2024-54444
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.27.4Update to 3.27.5
CVE-2024-13445
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings
≤3.25.9Update to 3.25.10
CVE-2024-10453
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.25.7Update to 3.25.8
CVE-2024-8236
Medium4.3Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
≤3.24.5Update to 3.24.6
CVE-2024-6757
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
≤3.23.4Update to 3.24.0
CVE-2024-5416
Medium6.4Authenticated (Contributor+) Arbitrary SVG Download
≤3.22.1Update to 3.22.2
CVE-2024-37437
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤3.21.5Update to 3.21.6
CVE-2024-4619
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget
≤3.20.2Update to 3.20.3
CVE-2024-2117
High8.8Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
≤3.19.0Update to 3.19.1
CVE-2024-24934
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
≤3.18.3Update to 3.19.0
CVE-2024-0506
High8.8Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
≤3.18.1Update to 3.18.2
CVE-2023-48777
Medium6.5Missing Authorization to Arbitrary Attachment Read
≤3.16.4Update to 3.16.5
CVE-2023-47504
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
≤3.16.4Update to 3.16.5
CVE-2023-47505
Medium6.1DOM-Based iFrame Injection
≤3.5.4Update to 3.5.5
CVE-2022-4953
Medium5.4Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item
<3.13.3Update to 3.13.3
CVE-2023-33922
Medium5.4Missing Authorization to Settings Update
≤3.13.1Update to 3.13.2
—
Medium6.6Authenticated(Administrator+) SQL Injection via 'replace_urls'
<3.12.2Update to 3.12.2
CVE-2023-0329
Medium6.1Unauthenticated DOM-based Reflected Cross-Site Scripting
≤3.5.5Update to 3.5.6
CVE-2022-29455
High8.83.6.2 - Missing Authorization to Remote Code Execution
3.6.0 – 3.6.2Update to 3.6.3
CVE-2022-1329
Medium6.1DOM-based Cross-Site Scripting
0.1.0 – 3.4.7Update to 3.4.8
CVE-2021-24891
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag
≤3.1.3Update to 3.1.4
CVE-2021-24204
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter
<3.1.4Update to 3.1.4
CVE-2021-24205
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via header_size
0.1.0 – 3.1.3Update to 3.1.4
CVE-2021-24202
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
0.1.0 – 3.1.3Update to 3.1.4
CVE-2021-24201
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
0.1.0 – 3.1.3Update to 3.1.4
CVE-2021-24203
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_size
0.1.0 – 3.1.3Update to 3.1.4
CVE-2021-24206
Medium6.4Unrestricted SVG Uploads
≤3.0.13Update to 3.0.14
CVE-2020-36171
Medium6.4Authenticated Stored Cross-Site Scripting
<2.9.14Update to 2.9.14
CVE-2020-15020
Medium5.4Stored Cross-Site Scripting
≤2.9.8Update to 2.9.9
CVE-2020-13865
Medium5.4Stored Cross-Site Scripting
≤2.9.8Update to 2.9.9
CVE-2020-13864
Medium6.4Authenticated Stored Cross-Site Scripting
≤2.9.7Update to 2.9.8
CVE-2020-36703
Medium6.5Authorization Bypass
≤2.9.5Update to 2.9.6
CVE-2020-20634
Medium6.4Stored Cross-Site Scripting
≤2.9.2Update to 2.9.3
CVE-2020-20406
Medium6.4Stored Cross-Site Scripting
≤2.7.5Update to 2.7.6
—
Medium6.1Reflected Cross-Site Scripting
≤2.8.4Update to 2.8.5
CVE-2020-8426
High7.2Cross-Site Scripting
≤2.8.3Update to 2.8.4
CVE-2020-7109
High8.8Arbitrary File Upload
<2.7.5Update to 2.7.5
CVE-2020-7055
High8.8Missing Authorization
≤1.7.12Update to 1.8.0
CVE-2017-18596

Elementor Website Builder – more than just a page builder: common questions

Does Elementor Website Builder – more than just a page builder have known vulnerabilities?

Yes. VulnCrest Radar lists 61 known vulnerabilities in Elementor Website Builder – more than just a page builder: 8 high, 53 medium. None are known to affect version null.

How do I check which version of Elementor Website Builder – more than just a page builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Elementor Website Builder – more than just a page builder vulnerability?

CVE-2026-104718, published Nov 11, 2026: Elementor Website Builder – more than just a page builder < 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Elementor Website Builder – more than just a page builder vulnerability listed in CISA KEV?

No. None of the known Elementor Website Builder – more than just a page builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?