Log in Start free

Elementor

Products

ProductCVEsExploitedLatest
Elementor Website Builder13–Nov 6, 2026
Elementor Pro4–Aug 19, 2026
Ally2–Feb 19, 2026
Activity Log1–Sep 2, 2026
Elementor Website Builder (WordPress plugin)1–Jun 13, 2022
Hello Elementor1–Apr 12, 2024
Image Optimizer by Elementor1–Feb 19, 2026

Exploited and recent CVEs

  • CVE-2026-109884 High 7.1 WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability –
  • CVE-2026-62062 High 8.8 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2026-84759 High 7.1 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-32475 Critical 9.0 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability 2.0%
  • CVE-2026-57619 Medium 6.5 WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability 0.4%
  • CVE-2026-49782 Medium 5.4 WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-32445 Low 2.7 WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability 0.2%
  • CVE-2026-32352 Medium 6.5 WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2024-50555 Medium 6.5 WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-25387 Medium 4.3 WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability 0.4%
  • CVE-2026-25386 Medium 5.3 WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability 0.2%
  • CVE-2025-67588 Medium 4.3 WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability 0.2%
  • CVE-2025-32640 Medium 5.9 WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-54444 Medium 6.5 WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-35656 High 7.1 WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-37437 Medium 5.5 WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability 0.3%
  • CVE-2023-35050 Medium 5.4 WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability 0.3%
  • CVE-2023-33922 Medium 4.3 WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability 0.3%
  • CVE-2024-24934 High 8.5 WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability 0.7%
  • CVE-2023-47504 Medium 6.5 WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability 1.5%
  • CVE-2024-31289 Medium 4.3 WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-23523 Medium 6.5 WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability 0.5%
  • CVE-2022-29455 Medium 4.7 WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability 23.7%