Elementor Pro
Elementor · 8 CVEs
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Aug 19, 2026
WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability
Jul 22, 2024
WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability
Jun 19, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ…
Mar 27, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Mar 27, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_…
Mar 27, 2024
Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting
Mar 27, 2024
WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability
Mar 16, 2024
Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option
Jun 7, 2023
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to ex…
Oct 7, 2020
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-32475 | WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability | CRITICAL | 1.71% | Aug 19, 2026 |
| CVE-2024-35656 | WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability | HIGH | 0.33% | Jul 22, 2024 |
| CVE-2023-35050 | WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability | MEDIUM | 0.31% | Jun 19, 2024 |
| CVE-2024-1521 | Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload | MEDIUM | 0.32% | Mar 27, 2024 |
| CVE-2024-2121 | Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | MEDIUM | 0.34% | Mar 27, 2024 |
| CVE-2024-2781 | Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag | MEDIUM | 0.32% | Mar 27, 2024 |
| CVE-2024-1364 | Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting | MEDIUM | 0.32% | Mar 27, 2024 |
| CVE-2024-23523 | WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability | MEDIUM | 0.53% | Mar 16, 2024 |
| CVE-2023-3124 | Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option | HIGH | 22.72% | Jun 7, 2023 |
| CVE-2020-26596 | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Ed… | HIGH | 5.70% | Oct 7, 2020 |
Showing 1 to 8 of 8 CVEs