EW
Product
Elementor Website Builder – more than just a page builder
17
CVEs
0
On KEV
6.4
Max CVSS
1
New 30D
Severity mix
Critical 0High 0Medium 17Low 0
Watch
Add Elementor Website Builder – more than just a page builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6127 | 6.4 | May 1 | Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Affected: through 4.0.4 |
| CVE-2025-14732 | 6.4 | Apr 8 | Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Affected: through 3.35.5 |
| CVE-2025-11220 | 6.4 | Dec 16 | Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path Affected: through 3.33.3 |
| CVE-2025-4566 | 6.4 | Jul 29 | Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget Affected: through 3.30.2 |
| CVE-2025-3075 | 5.4 | Jul 29 | Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 3.29.0 |
| CVE-2024-13445 | 5.4 | Feb 20 | Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 3.27.4 |
| CVE-2024-10453 | 5.4 | Dec 21 | Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings Affected: through 3.25.9 |
| CVE-2024-8236 | 5.4 | Nov 26 | Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 3.25.7 |
| CVE-2024-5416 | 5.4 | Sep 11 | Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets Affected: through 3.23.4 |
| CVE-2024-4619 | 5.4 | May 21 | Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Affected: through 3.21.5 |
| CVE-2024-2117 | 5.4 | Apr 9 | Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget Affected: through 3.20.2 |
| CVE-2024-0506 | 5.4 | Feb 20 | Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt Affected: through 3.18.3 |
| CVE-2020-36703 | 5.4 | Jun 7 | Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting Affected: through 2.9.7 |
| CVE-2025-8081 | 4.9 | Aug 12 | Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import Affected: through 3.30.2 |
| CVE-2026-11905 | 4.3 | Oct 15 | Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters Affected: through 4.2.3 |
| CVE-2026-1206 | 4.3 | Mar 26 | Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template Affected: through 3.35.7 |
| CVE-2024-6757 | 4.3 | Oct 15 | Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function Affected: through 3.24.5 |
Showing 17