Elemntor vulnerabilities
We track 5 vulnerabilities in Elemntor products across 5 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2026.
Latest Elemntor vulnerabilities
- 8.1 High severity
Image Optimizer – Compress Images and Convert…: External Control of File Name or Path
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used dir
- 9.8 Critical severity
Temporary Login: Authentication Bypass Using an Alternate Path or Channel
The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET
- 7.5 High severity
Ally – Web Accessibility & Usability: Improper Neutralization of Special Elements used in an SQL Command
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()
- 7.2 High severity
Activity Log – Monitor & Record User Changes: Improper Neutralization of Input During Web Page Generation
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it p
- 8.8 High severity
Elementor Website Builder: Missing Authorization
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in