Vendor

    Elemntor

    25 known vulnerabilities in products by Elemntor, 0 of them actively exploited (CISA KEV).

    Key figures

    25

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Elemntor
    CriticalCVE-2026-7567

    Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

    		9.8
    HighCVE-2022-1329

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    also in 1 other product

    		8.8
    HighCVE-2026-2413

    Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path

    		7.5
    HighCVE-2026-5821

    External Control of File Name or Path (CVE-2026-5821)

    		8.1
    HighCVE-2024-10788

    Elemntor Activity Log: Cross-site Scripting

    also in 1 other product

    		7.2
    MediumCVE-2026-5727

    Elemntor Hello Plus: Missing Authorization

    		5.4
    MediumCVE-2026-11905

    Elemntor Elementor Website Builder: Missing Authorization

    		4.3
    MediumCVE-2025-14732

    Elemntor Elementor Website Builder: Improper Neutralization of Alternate XSS Syntax

    		6.4
    MediumCVE-2025-8081

    Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

    also in 1 other product

    		4.9
    HighCVE-2025-1319

    Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting

    also in 1 other product

    		7.2
    MediumCVE-2026-6127

    Elemntor Elementor Website Builder: Cross-site Scripting

    		6.4
    MediumCVE-2024-2117

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-0506

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2020-36703

    Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-8236

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-4619

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-11220

    Elemntor Elementor Website Builder: Cross-site Scripting

    		6.4
    MediumCVE-2025-4566

    Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

    		6.4
    MediumCVE-2024-10453

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-13445

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-3075

    Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-5416

    Elemntor Elementor Website Builder: Cross-site Scripting

    also in 1 other product

    		5.4
    MediumCVE-2026-1206

    Elemntor Elementor Website Builder: Authorization Bypass Through User-Controlled Key

    		4.3
    MediumCVE-2024-6757

    Elemntor Elementor Website Builder: Exposure of Sensitive Information to an Unauthorized Actor

    also in 1 other product

    		4.3
    MediumCVE-2025-10700

    Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update

    		4.3

    Products

    Products by Elemntor
    Elementor Website Builder – More Than Just A Page Builder170