Product by Elementor

    Elementor Website Builder

    37 known vulnerabilities in Elementor Website Builder (Elementor), 0 of them actively exploited (CISA KEV).

    Key figures

    37

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Elementor Website Builder (Elementor)
    HighCVE-2022-1329

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    also in 1 other product

    		8.8
    CriticalCVE-2023-48777

    WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

    		9.9
    HighCVE-2023-0329

    Elementor Website Builder < 3.12.2 - Admin+ SQLi

    		7.2
    MediumCVE-2023-47505

    WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

    		6.5
    MediumCVE-2021-24891

    Elementor < 3.4.8 - DOM Cross-Site-Scripting

    		6.1
    MediumCVE-2022-29455

    Elementor Website Builder (WordPress plugin): Cross-site Scripting

    		4.7
    MediumCVE-2022-4953

    Elementor < 3.5.5 - Iframe Injection

    		6.1
    CriticalCVE-2020-7109

    Elementor Website Builder – more than just a page builder: security vulnerability

    		9.8
    CriticalCVE-2023-47504

    Elementor Website Builder: Improper Authentication

    also in 1 other product

    		6.5
    HighCVE-2024-24934

    Elementor Website Builder: Path Traversal

    also in 1 other product

    		8.5
    MediumCVE-2020-8426

    Elementor Website Builder – more than just a page builder: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2020-20634

    Elementor Website Builder – more than just a page builder: security vulnerability

    		6.5
    MediumCVE-2020-36171

    Elementor Website Builder – more than just a page builder: security vulnerability

    		6.1
    MediumCVE-2025-8081

    Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

    also in 1 other product

    		4.9
    MediumCVE-2021-24205

    Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget

    		5.4
    MediumCVE-2021-24204

    Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget

    		5.4
    MediumCVE-2021-24206

    Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget

    		5.4
    MediumCVE-2021-24202

    Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget

    		5.4
    MediumCVE-2021-24203

    Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget

    		5.4
    MediumCVE-2021-24201

    Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element

    		5.4
    MediumCVE-2024-2117

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2020-15020

    Elementor Website Builder – more than just a page builder: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2024-0506

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2020-36703

    Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-8236

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4

    All vulnerabilities in search

    All products by Elementor