Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Elementor Website Builder – more than just a page builder — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in Elementor Website Builder – more than just a page builder, with AI-generated Chinese analysis, references, and POCs.

This vulnerability aggregation page focuses on the Elementor Website Builder, a popular WordPress plugin categorized as a web development tool. It systematically collects security advisories related to known weaknesses and flaws discovered within this specific product ecosystem. The data spans from early releases up to the present day, offering a comprehensive timeline of security issues. By consolidating these records, the page serves as a centralized reference for security researchers, developers, and site administrators. Users can track a vendor's historical advisories to understand the frequency and nature of reported security incidents. It also allows for a deeper understanding of specific weakness classes, such as cross-site scripting or unauthorized access, as they apply to Elementor. Furthermore, individuals can look up a product's vulnerability history to assess the overall security posture and remediation effectiveness over time. This information is critical for evaluating the risks associated with using the plugin in production environments. The aggregation highlights patterns in how bugs are introduced and fixed, providing insights into the development lifecycle's security maturity. Access to this structured data helps stakeholders make informed decisions about plugin updates, security configurations, and dependency management. Rather than presenting isolated incidents, this overview contextualizes vulnerabilities within the broader history of the Elementor product. It supports proactive security measures by revealing trends in defect types and resolution speeds. This resource is designed to enhance transparency and facilitate better risk management practices for anyone relying on this website building platform.

Vendor: elemntor

CVE IDTitleCVSSSeverityPublished
CVE-2026-6127 Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API CWE-79 6.4 Medium2026-05-01
CVE-2025-14732 Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API CWE-87 6.4 Medium2026-04-08
CVE-2026-1206 Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template CWE-639 4.3 Medium2026-03-26
CVE-2025-11220 Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path CWE-79 6.4 Medium2025-12-16
CVE-2025-8081 Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import CWE-22 4.9 Medium2025-08-12
CVE-2025-4566 Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget CWE-79 6.4 Medium2025-07-29
CVE-2025-3075 Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2025-07-29
CVE-2024-13445 Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2025-02-20
CVE-2024-10453 Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings CWE-79 6.4 Medium2024-12-21
CVE-2024-8236 Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2024-11-26
CVE-2024-6757 Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function CWE-200 4.3 Medium2024-10-15
CVE-2024-5416 Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets CWE-79 5.4 Medium2024-09-11
CVE-2024-4619 Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CWE-79 6.4 Medium2024-05-21
CVE-2024-2117 Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget CWE-79 6.4 Medium2024-04-09
CVE-2024-0506 Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt CWE-79 6.4 Medium2024-02-20
CVE-2020-36703 Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting CWE-79 6.4 Medium2023-06-07

All 16 known CVE vulnerabilities affecting Elementor Website Builder – more than just a page builder with full Chinese analysis, references, and POCs where available.