WB
Product
Website Builder
38
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 32Low 0
Watch
Add Website Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-47504 | 9.8 | Apr 24 | WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability Affected: before 3.16.5 |
| CVE-2020-7109 | 9.8 | Jan 22 | The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template Affected: before 2.8.4 |
| CVE-2023-48777 | 8.8 | Mar 26 | WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability Affected: 3.3.0 before 3.18.2 |
| CVE-2022-1329 | 8.8 | Apr 19 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the… Affected: 3.6.0 through 3.6.2 |
| CVE-2024-24934 | 8.1 | May 17 | WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability Affected: before 3.19.1 |
| CVE-2023-0329 | 7.2 | May 30 | Elementor Website Builder < 3.12.2 - Admin+ SQLi Affected: before 3.12.2 |
| CVE-2024-8494 | 6.5 | Jan 30 | Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode Affected: before 3.25.11 |
| CVE-2020-20634 | 6.5 | Aug 21 | Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature Affected: through 2.9.5 |
| CVE-2022-4953 | 6.1 | Aug 14 | Elementor < 3.5.5 - Iframe Injection Affected: before 3.5.5 |
| CVE-2022-29455 | 6.1 | Jun 13 | DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions Affected: through 3.5.5 |
| CVE-2021-24891 | 6.1 | Nov 23 | The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site… Affected: after 1.5.0 before 3.1.4; 3.2.0 before 3.4.8 |
| CVE-2020-36171 | 6.1 | Jan 6 | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads Affected: before 3.0.14 |
| CVE-2025-3075 | 5.4 | Jul 29 | Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 3.29.1 |
| CVE-2024-54444 | 5.4 | Feb 25 | WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability Affected: through 3.25.10 |
| CVE-2024-13445 | 5.4 | Feb 20 | Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 3.27.5 |
| CVE-2024-10453 | 5.4 | Dec 21 | Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings Affected: through 3.25.9 |
| CVE-2024-8236 | 5.4 | Nov 26 | Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 3.25.7 |
| CVE-2024-5416 | 5.4 | Sep 11 | Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets Affected: before 3.24.0 |
| CVE-2024-37437 | 5.4 | Jul 9 | WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability Affected: before 3.22.2 |
| CVE-2024-4619 | 5.4 | May 21 | Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Affected: before 3.21.5 |
| CVE-2024-4107 | 5.4 | May 9 | Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Affected: before 3.21.1 |
| CVE-2024-2117 | 5.4 | Apr 9 | Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget Affected: before 3.20.3 |
| CVE-2024-2120 | 5.4 | Mar 27 | Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Affected: before 3.20.2 |
| CVE-2024-2781 | 5.4 | Mar 27 | Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag Affected: through 3.20.1 |
| CVE-2024-0506 | 5.4 | Feb 20 | Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt Affected: before 3.19.0 |
| CVE-2023-47505 | 5.4 | Nov 30 | WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS) Affected: through 3.16.4 |
| CVE-2020-36703 | 5.4 | Jun 7 | Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting Affected: through 2.9.7 |
| CVE-2021-24206 | 5.4 | Apr 5 | In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter Affected: before 3.1.4 |
| CVE-2021-24205 | 5.4 | Apr 5 | In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter Affected: before 3.1.4 |
| CVE-2021-24204 | 5.4 | Apr 5 | In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter Affected: before 3.1.4 |
| CVE-2021-24203 | 5.4 | Apr 5 | In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter Affected: before 3.1.4 |
| CVE-2021-24202 | 5.4 | Apr 5 | In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter Affected: before 3.1.4 |
| CVE-2021-24201 | 5.4 | Apr 5 | In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter Affected: before 3.1.4 |
| CVE-2020-15020 | 5.4 | Aug 31 | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress Affected: through 2.9.13 |
| CVE-2020-8426 | 5.4 | Jan 28 | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page Affected: before 2.8.5 |
| CVE-2025-8081 | 4.9 | Aug 12 | Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import Affected: before 3.30.3 |
| CVE-2024-6757 | 4.3 | Oct 15 | Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function Affected: before 3.24.6 |
| CVE-2023-33922 | 4.3 | Jun 11 | WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability Affected: before 3.13.3 |
Showing 38