Elementor Pro Vulnerabilities

The Elementor Pro plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 4.2.1 via the process_field function. This is due to a validation loop in Upload::validation() using 'return' instead of 'continue' when the first array element has UPLOAD_ERR_NO_FILE, aborting al...

CVSS:

9.8

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Aug 19, 2026

CVE-2026-32475 on NVD →

The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 3.29.0

Fixed in:

3.29.1

Disclosed:

Jun 19, 2025

CVE-2024-50555 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

CVSS:

6.4

Affected:

up to 3.29.0

Fixed in:

3.29.1

Disclosed:

Jun 9, 2025

CVE-2025-3076 on NVD →

Affected:

up to 3.29.1

Fixed in:

3.29.1

Disclosed:

Jun 9, 2025

CVE-2025-3076 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including th...

CVSS:

4.3

Affected:

up to 3.25.10

Fixed in:

3.25.11

Disclosed:

Jan 29, 2025

CVE-2024-8494 on NVD →

Affected:

up to 3.25.11

Fixed in:

3.25.11

Disclosed:

Jan 29, 2025

CVE-2024-8494 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This issue affects Elementor Pro: from n/a through 3.21.2.

Affected:

up to 3.21.3

Fixed in:

3.21.3

Disclosed:

Jul 22, 2024

CVE-2024-35656 on NVD →

The Elementor Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.21.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 3.21.2

Fixed in:

3.21.3

Disclosed:

Jun 28, 2024

CVE-2024-35656 on NVD →

Affected:

up to 3.21.3

Fixed in:

3.21.3

Disclosed:

Jun 28, 2024

CVE-2024-35656 on NVD →

[en] Missing Authorization vulnerability in Elementor Elementor Pro.This issue affects Elementor Pro: from n/a through 3.13.0.

Affected:

up to 3.13.1

Fixed in:

3.13.1

Disclosed:

Jun 19, 2024

CVE-2023-35050 on NVD →

[en] The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

Affected:

up to 3.21.2

Fixed in:

3.21.2

Disclosed:

May 9, 2024

CVE-2024-4107 on NVD →

The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with con...

CVSS:

6.4

Affected:

up to 3.21.0

Fixed in:

3.21.2

Disclosed:

May 2, 2024

CVE-2024-4107 on NVD →

Affected:

up to 3.21.2

Fixed in:

3.21.2

Disclosed:

May 2, 2024

CVE-2024-4107 on NVD →

[en] The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with con...

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 27, 2024

CVE-2024-1364 on NVD →

[en] The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated at...

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 27, 2024

CVE-2024-2121 on NVD →

[en] The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 27, 2024

CVE-2024-2120 on NVD →

[en] The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access o...

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 27, 2024

CVE-2024-2781 on NVD →

[en] The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contrib...

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 27, 2024

CVE-2024-1521 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-...

CVSS:

6.4

Affected:

up to 3.20.1

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-1521 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or hig...

CVSS:

6.4

Affected:

up to 3.20.1

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-2781 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribu...

CVSS:

6.4

Affected:

up to 3.20.1

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-1364 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack...

CVSS:

5.4

Affected:

up to 3.20.1

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-2120 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

CVSS:

5.4

Affected:

up to 3.20.1

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-2121 on NVD →

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-1521 on NVD →

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-2121 on NVD →

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-2781 on NVD →

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-1364 on NVD →

Affected:

up to 3.20.2

Fixed in:

3.20.2

Disclosed:

Mar 26, 2024

CVE-2024-2120 on NVD →

[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2.

Affected:

up to 3.19.3

Fixed in:

3.19.3

Disclosed:

Mar 16, 2024

CVE-2024-23523 on NVD →

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.19.2 . This makes it possible for authenticated attackers, with contributor-level access and above, to extract arbitrary user meta values.

CVSS:

4.3

Affected:

up to 3.19.2

Fixed in:

3.19.3

Disclosed:

Feb 26, 2024

CVE-2024-23523 on NVD →

Affected:

up to 3.19.3

Fixed in:

3.19.3

Disclosed:

Feb 26, 2024

CVE-2024-23523 on NVD →

The Elementor Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.13.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perf...

CVSS:

6.3

Affected:

up to 3.13.0

Fixed in:

3.13.1

Disclosed:

Jun 20, 2023

CVE-2023-35050 on NVD →

[en] The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site option...

Affected:

up to 3.11.7

Fixed in:

3.11.7

Disclosed:

Jun 7, 2023

CVE-2023-3124 on NVD →

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, wh...

CVSS:

8.8

Affected:

up to 3.11.6

Fixed in:

3.11.7

Disclosed:

Mar 28, 2023

CVE-2023-3124 on NVD →

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, wh...

Affected:

up to 3.11.7

Fixed in:

3.11.7

Disclosed:

Mar 28, 2023

Update the WordPress Elementor Pro plugin to the latest available version (at least 3.11.7). JEROME BRUANDET discovered and reported this Broken Access Control vulnerability in WordPress Elementor Pro Plugin. This vulnerability has been fixed in version 3.11.7.

Affected:

up to 3.11.7

Fixed in:

3.11.7

Disclosed:

Mar 28, 2023

Affected:

up to 3.11.7

Fixed in:

3.11.7

Disclosed:

Mar 28, 2023

CVE-2023-3124 on NVD →

[en] The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restri...

Affected:

up to 3.0.6

Fixed in:

3.0.6

Disclosed:

Oct 7, 2020

CVE-2020-26596 on NVD →

The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting...

CVSS:

7.2

Affected:

up to 3.0.5

Fixed in:

3.0.6

Disclosed:

Oct 6, 2020

CVE-2020-26596 on NVD →

[en] An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.

Affected:

up to 2.9.4

Fixed in:

2.9.4

Disclosed:

May 17, 2020

CVE-2020-13125 on NVD →

[en] An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.

Affected:

up to 2.9.4

Fixed in:

2.9.4

Disclosed:

May 17, 2020

CVE-2020-13126 on NVD →

Affected:

up to 2.9.4

Fixed in:

2.9.4

Disclosed:

May 7, 2020

CVE-2020-13126 on NVD →

An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.

CVSS:

9.9

Affected:

up to 2.9.4

Fixed in:

2.9.4

Disclosed:

May 6, 2020

CVE-2020-13126 on NVD →

[en] The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.

Affected:

up to 2.0.10

Fixed in:

2.0.10

Disclosed:

Oct 7, 2019

CVE-2018-18379 on NVD →

The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 2.0.10

Fixed in:

2.0.10

Disclosed:

Oct 26, 2018

CVE-2018-18379 on NVD →

Affected:

up to 2.0.10

Fixed in:

2.0.10

Disclosed:

Oct 26, 2018

CVE-2018-18379 on NVD →

Affected:

up to 3.25.11

Fixed in:

3.25.11

CVE-2024-8494 on NVD →

Affected:

up to 3.29.1

Fixed in:

3.29.1

CVE-2025-3076 on NVD →

Affected:

up to 3.29.1

Fixed in:

3.29.1

CVE-2024-50555 on NVD →