Skip to content
OpenAdvisories

Vendor

elemntor

25 known vulnerabilities.

Products

Elementor Website Builder – more than just a page builder 17 Ally – Web Accessibility & Usability 2 Elementor Website Builder 1 Activity Log – Monitor & Record User Changes 1 Hello Plus 1 Temporary Login 1 Site Mailer – SMTP Replacement, Email API Deliverability & Email Log 1 Image Optimizer – Compress Images and Convert to WebP or AVIF 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.1
    CVE-2026-5821

    Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

    The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used di…

    elemntor Image Optimizer – Compress Images and Convert to WebP or AVIF Web / CMS
  • High 7.5
    CVE-2026-2413 Public exploit Scanner template

    Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path

    The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations(…

    elemntor Ally – Web Accessibility & Usability Web / CMS
  • High 7.2
    CVE-2025-1319

    Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting

    The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it po…

    elemntor Site Mailer – SMTP Replacement, Email API Deliverability & Email Log Web / CMS
  • High 7.2
    CVE-2024-10788

    Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context

    The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it …

    elemntor Activity Log – Monitor & Record User Changes Web / CMS
  • High 8.8
    CVE-2022-1329 Public exploit Scanner template EPSS 93%

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data i…

    elemntor Elementor Website Builder Web / CMS