EN ES
Start free
Menu

Elementor Website Builder: known security problems

57 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 57 known security problems on this page. Each one has a fixed version. Updating to version 4.3.5 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.4
Fixed in
4.3.5
What to do
If your site has an affected version, update Elementor Website Builder to version 4.3.5 or newer.
Official ID
CVE-2026-81812
Report title
Elementor <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.3.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.4
Fixed in
4.3.5
What to do
If your site has an affected version, update Elementor Website Builder to version 4.3.5 or newer.
Official ID
CVE-2026-81813
Report title
Elementor <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see (up to and including 4.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.3
Fixed in
4.2.4
What to do
If your site has an affected version, update Elementor Website Builder to version 4.2.4 or newer.
Official ID
CVE-2026-11905
Report title
Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
First reported
Sources
This week

Someone could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 4.3.0 up to and including 4.3.1
Fixed in
4.3.2
What to do
If your site has an affected version, update Elementor Website Builder to version 4.3.2 or newer.
Official ID
CVE-2026-62062
Report title
Elementor Website Builder 4.3.0 - 4.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see (up to and including 4.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.3
Fixed in
4.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 4.1.4 or newer.
Official ID
CVE-2026-8825
Report title
Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see (up to and including 4.1.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.3
Fixed in
4.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 4.1.4 or newer.
Official ID
CVE-2026-57619
Report title
Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Elementor Website Builder to version 4.1.1 or newer.
Official ID
CVE-2026-49782
Report title
Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.4
Fixed in
4.0.5
What to do
If your site has an affected version, update Elementor Website Builder to version 4.0.5 or newer.
Official ID
CVE-2026-6127
Report title
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.35.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35.5
Fixed in
3.35.6
What to do
If your site has an affected version, update Elementor Website Builder to version 3.35.6 or newer.
Official ID
CVE-2025-14732
Report title
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see (up to and including 3.35.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35.7
Fixed in
3.35.8
What to do
If your site has an affected version, update Elementor Website Builder to version 3.35.8 or newer.
Official ID
CVE-2026-1206
Report title
Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.35.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35.5
Fixed in
3.35.6
What to do
If your site has an affected version, update Elementor Website Builder to version 3.35.6 or newer.
Official ID
CVE-2026-32445
Report title
Elementor Website Builder <= 3.35.5 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.35.5) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.35.5
Fixed in
3.35.6
What to do
If your site has an affected version, update Elementor Website Builder to version 3.35.6 or newer.
Official ID
CVE-2026-32352
Report title
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.33.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.33.3
Fixed in
3.33.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.33.4 or newer.
Official ID
CVE-2025-11220
Report title
Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.33.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.33.0
Fixed in
3.33.1
What to do
If your site has an affected version, update Elementor Website Builder to version 3.33.1 or newer.
Official ID
CVE-2025-67588
Report title
Elementor Website Builder <= 3.33.0 - Missing Authorization
First reported
Sources
This week

Someone who already has an admin account could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.30.2
Fixed in
3.30.3
What to do
If your site has an affected version, update Elementor Website Builder to version 3.30.3 or newer.
Official ID
CVE-2025-8081
Report title
Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.29.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.29.0
Fixed in
3.29.1
What to do
If your site has an affected version, update Elementor Website Builder to version 3.29.1 or newer.
Official ID
CVE-2025-3075
Report title
Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.30.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.30.2
Fixed in
3.30.3
What to do
If your site has an affected version, update Elementor Website Builder to version 3.30.3 or newer.
Official ID
CVE-2025-4566
Report title
Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.29.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.29.0
Fixed in
3.29.1
What to do
If your site has an affected version, update Elementor Website Builder to version 3.29.1 or newer.
Official ID
CVE-2024-50555
Report title
Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.25.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.25.10
Fixed in
3.25.11
What to do
If your site has an affected version, update Elementor Website Builder to version 3.25.11 or newer.
Official ID
CVE-2024-54444
Report title
Elementor Website Builder <= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.27.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.27.4
Fixed in
3.27.5
What to do
If your site has an affected version, update Elementor Website Builder to version 3.27.5 or newer.
Official ID
CVE-2024-13445
Report title
Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.25.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.25.9
Fixed in
3.25.10
What to do
If your site has an affected version, update Elementor Website Builder to version 3.25.10 or newer.
Official ID
CVE-2024-10453
Report title
Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.25.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.25.7
Fixed in
3.25.8
What to do
If your site has an affected version, update Elementor Website Builder to version 3.25.8 or newer.
Official ID
CVE-2024-8236
Report title
Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.24.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.24.5
Fixed in
3.24.6
What to do
If your site has an affected version, update Elementor Website Builder to version 3.24.6 or newer.
Official ID
CVE-2024-6757
Report title
Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.23.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.23.4
Fixed in
3.24.0
What to do
If your site has an affected version, update Elementor Website Builder to version 3.24.0 or newer.
Official ID
CVE-2024-5416
Report title
Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.22.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.22.1
Fixed in
3.22.2
What to do
If your site has an affected version, update Elementor Website Builder to version 3.22.2 or newer.
Official ID
CVE-2024-37437
Report title
Elementor Website Builder <= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.21.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.21.5
Fixed in
3.21.6
What to do
If your site has an affected version, update Elementor Website Builder to version 3.21.6 or newer.
Official ID
CVE-2024-4619
Report title
Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.20.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.20.2
Fixed in
3.20.3
What to do
If your site has an affected version, update Elementor Website Builder to version 3.20.3 or newer.
Official ID
CVE-2024-2117
Report title
Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.18.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.18.3
Fixed in
3.19.0
What to do
If your site has an affected version, update Elementor Website Builder to version 3.19.0 or newer.
Official ID
CVE-2024-0506
Report title
Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.19.0
Fixed in
3.19.1
What to do
If your site has an affected version, update Elementor Website Builder to version 3.19.1 or newer.
Official ID
CVE-2024-24934
Report title
Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
First reported
Sources
This week

Someone with a contributor account on your site could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.18.1
Fixed in
3.18.2
What to do
If your site has an affected version, update Elementor Website Builder to version 3.18.2 or newer.
Official ID
CVE-2023-48777
Report title
Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.16.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16.4
Fixed in
3.16.5
What to do
If your site has an affected version, update Elementor Website Builder to version 3.16.5 or newer.
Official ID
CVE-2023-47505
Report title
Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.16.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16.4
Fixed in
3.16.5
What to do
If your site has an affected version, update Elementor Website Builder to version 3.16.5 or newer.
Official ID
CVE-2023-47504
Report title
Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.4
Fixed in
3.5.5
What to do
If your site has an affected version, update Elementor Website Builder to version 3.5.5 or newer.
Official ID
CVE-2022-4953
Report title
Elementor <= 3.5.4 - DOM-Based iFrame Injection
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (before 3.13.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.13.3
Fixed in
3.13.3
What to do
If your site has an affected version, update Elementor Website Builder to version 3.13.3 or newer.
Official ID
CVE-2023-33922
Report title
Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.13.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13.1
Fixed in
3.13.2
What to do
If your site has an affected version, update Elementor Website Builder to version 3.13.2 or newer.
Report title
Elementor <= 3.13.1 - Missing Authorization to Settings Update
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.12.2
Fixed in
3.12.2
What to do
If your site has an affected version, update Elementor Website Builder to version 3.12.2 or newer.
Official ID
CVE-2023-0329
Report title
Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.5
Fixed in
3.5.6
What to do
If your site has an affected version, update Elementor Website Builder to version 3.5.6 or newer.
Official ID
CVE-2022-29455
Report title
Elementor Website Builder <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (from 3.6.0 up to and including 3.6.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.6.0 up to and including 3.6.2
Fixed in
3.6.3
What to do
If your site has an affected version, update Elementor Website Builder to version 3.6.3 or newer.
Official ID
CVE-2022-1329
Report title
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 0.1.0 up to and including 3.4.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 0.1.0 up to and including 3.4.7
Fixed in
3.4.8
What to do
If your site has an affected version, update Elementor Website Builder to version 3.4.8 or newer.
Official ID
CVE-2021-24891
Report title
Elementor Website Builder <= 3.4.7 - DOM-based Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.1.4 or newer.
Official ID
CVE-2021-24204
Report title
Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 0.1.0 up to and including 3.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 0.1.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.1.4 or newer.
Official ID
CVE-2021-24206
Report title
Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 0.1.0 up to and including 3.1.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 0.1.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.1.4 or newer.
Official ID
CVE-2021-24201
Report title
Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 3.1.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.4
Fixed in
3.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.1.4 or newer.
Official ID
CVE-2021-24205
Report title
Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 0.1.0 up to and including 3.1.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 0.1.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.1.4 or newer.
Official ID
CVE-2021-24202
Report title
Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 0.1.0 up to and including 3.1.3) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 0.1.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update Elementor Website Builder to version 3.1.4 or newer.
Official ID
CVE-2021-24203
Report title
Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.0.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.13
Fixed in
3.0.14
What to do
If your site has an affected version, update Elementor Website Builder to version 3.0.14 or newer.
Official ID
CVE-2020-36171
Report title
Elementor Website Builder <= 3.0.13 - Unrestricted SVG Uploads
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.9.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.14
Fixed in
2.9.14
What to do
If your site has an affected version, update Elementor Website Builder to version 2.9.14 or newer.
Official ID
CVE-2020-15020
Report title
Elementor Website Builder <= 2.9.13 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.8
Fixed in
2.9.9
What to do
If your site has an affected version, update Elementor Website Builder to version 2.9.9 or newer.
Official ID
CVE-2020-13864
Report title
Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.8) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.8
Fixed in
2.9.9
What to do
If your site has an affected version, update Elementor Website Builder to version 2.9.9 or newer.
Official ID
CVE-2020-13865
Report title
Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.7
Fixed in
2.9.8
What to do
If your site has an affected version, update Elementor Website Builder to version 2.9.8 or newer.
Official ID
CVE-2020-36703
Report title
Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.9.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.5
Fixed in
2.9.6
What to do
If your site has an affected version, update Elementor Website Builder to version 2.9.6 or newer.
Official ID
CVE-2020-20634
Report title
Elementor Website Builder <= 2.9.5 - Authorization Bypass
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.2
Fixed in
2.9.3
What to do
If your site has an affected version, update Elementor Website Builder to version 2.9.3 or newer.
Official ID
CVE-2020-20406
Report title
Elementor Website Builder <= 2.9.2 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.5
Fixed in
2.7.6
What to do
If your site has an affected version, update Elementor Website Builder to version 2.7.6 or newer.
Report title
Elementor Website Builder <= 2.7.5 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.8.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.4
Fixed in
2.8.5
What to do
If your site has an affected version, update Elementor Website Builder to version 2.8.5 or newer.
Official ID
CVE-2020-8426
Report title
Elementor Website Builder <= 2.8.4 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.3
Fixed in
2.8.4
What to do
If your site has an affected version, update Elementor Website Builder to version 2.8.4 or newer.
Official ID
CVE-2020-7109
Report title
Elementor Website Builder <= 2.8.3 - Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (before 2.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.7.5
Fixed in
2.7.5
What to do
If your site has an affected version, update Elementor Website Builder to version 2.7.5 or newer.
Official ID
CVE-2020-7055
Report title
Elementor Website Builder <= 2.7.4 - Arbitrary File Upload
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.7.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.12
Fixed in
1.8.0
What to do
If your site has an affected version, update Elementor Website Builder to version 1.8.0 or newer.
Official ID
CVE-2017-18596
Report title
Elementor Website Builder <= 1.7.12 - Missing Authorization
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)