Skip to content
OpenAdvisories

Vendor

elemntor

25 known vulnerabilities.

Products

Elementor Website Builder – more than just a page builder 17 Ally – Web Accessibility & Usability 2 Elementor Website Builder 1 Activity Log – Monitor & Record User Changes 1 Hello Plus 1 Temporary Login 1 Site Mailer – SMTP Replacement, Email API Deliverability & Email Log 1 Image Optimizer – Compress Images and Convert to WebP or AVIF 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-7567 Public exploit

    Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

    The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET…

    elemntor Temporary Login Web / CMS
  • High 7.5
    CVE-2026-2413 Public exploit

    Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path

    The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations(…

    elemntor Ally – Web Accessibility & Usability Web / CMS
  • Medium 4.9
    CVE-2025-8081 Public exploit

    Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

    The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated atta…

    elemntor Elementor Website Builder – more than just a page builder Web / CMS
  • High 8.8
    CVE-2022-1329 Public exploit EPSS 93%

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data i…

    elemntor Elementor Website Builder Web / CMS