Elementor vulnerabilities

We track 10 vulnerabilities in Elementor products across 4 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.

10vulnerabilities

2critical

8high

0exploited

8.5average CVSS score

Latest Elementor vulnerabilities

7.1 High severity
Elementor Website Builder: Improper Neutralization of Input During Web Page Generation
CVE-2026-109884Nov 6, 2026Elementor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.
7.1 High severity
Elementor Website Builder: Improper Neutralization of Input During Web Page Generation
CVE-2026-109883Nov 6, 2026Elementor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.
8.8 High severity
Elementor Website Builder: Cross-Site Request Forgery
CVE-2026-62062Sep 25, 2026Elementor
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.
9.0 Critical severity
Elementor Pro: Unrestricted Upload of File with Dangerous Type
CVE-2026-32475Aug 19, 2026ElementorEPSS 1.99%
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
8.1 High severity
Elementor Website Builder: Improper Limitation of a Pathname to a Restricted Directory
CVE-2024-24934May 17, 2024Elementor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0.
9.8 Critical severity
Elementor Website Builder: Improper Authentication
CVE-2023-47504Apr 24, 2024ElementorEPSS 1.71%
Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elementor Website Builder: from n/a through 3.16.4.
8.8 High severity
Prime Slider – Addons For Elementor: Missing Authorization
CVE-2024-32681Apr 22, 2024BdThemes
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
8.8 High severity
Elementor Website Builder: Unrestricted Upload of File with Dangerous Type
CVE-2023-48777Mar 26, 2024Elementor.comEPSS 4.1%
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.
8.8 High severity
Elementor Website Builder Pro: Missing Authorization
CVE-2023-3124Jun 7, 2023Https://elementor.com/EPSS 22.7%
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscr
8.8 High severity
Elementor Website Builder: Missing Authorization
CVE-2022-1329Apr 19, 2022ElemntorEPSS 92.7%
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in