Skip to content
OpenAdvisories

Vendor

Elementor

25 known vulnerabilities.

Products

Elementor Website Builder 15 Elementor Pro 4 Ally 2 Image Optimizer by Elementor 1 Elementor Website Builder (WordPress plugin) 1 Activity Log 1 Hello Elementor 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-109884

    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

    Elementor Elementor Website Builder
  • High 7.1
    CVE-2026-109883

    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

    Elementor Elementor Website Builder
  • High 8.8
    CVE-2026-62062 Public exploit

    WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

    Elementor Elementor Website Builder
  • High 7.1
    CVE-2026-84759

    WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

    Elementor Activity Log
  • High 7.1
    CVE-2024-35656

    WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This issue affects Elementor Pro: from n/a through 3.21.2.

    Elementor Elementor Pro
  • High 8.5
    CVE-2024-24934

    WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0.

    Elementor Elementor Website Builder