Log in Start free

elemntor

Products

ProductCVEsExploitedLatest
Elementor Website Builder – more than just a page builder17–Oct 15, 2026
Ally – Web Accessibility & Usability2–Mar 11, 2026
Hello Plus1–Oct 10, 2026
Image Optimizer – Compress Images and Convert to WebP or AVIF1–Jul 2, 2026
Site Mailer – SMTP Replacement, Email API Deliverability & Email Log1–Feb 28, 2025
Activity Log – Monitor & Record User Changes1–Nov 21, 2024
Temporary Login1–May 1, 2026
Elementor Website Builder 1–Apr 19, 2022

Exploited and recent CVEs

  • CVE-2026-11905 Medium 4.3 Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters 0.3%
  • CVE-2026-5727 Medium 5.4 Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site 0.2%
  • CVE-2026-5821 High 8.1 Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection 0.8%
  • CVE-2026-7567 Critical 9.8 Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover 9.2%
  • CVE-2026-6127 Medium 6.4 Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API 0.2%
  • CVE-2025-14732 Medium 6.4 Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API 0.3%
  • CVE-2026-1206 Medium 4.3 Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template 0.3%
  • CVE-2026-2413 High 7.5 Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path 2.4%
  • CVE-2025-11220 Medium 6.4 Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path 0.2%
  • CVE-2025-10700 Medium 4.3 Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update 0.2%
  • CVE-2025-8081 Medium 4.9 Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import 0.6%
  • CVE-2025-4566 Medium 6.4 Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget 0.3%
  • CVE-2025-3075 Medium 6.4 Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-1319 High 7.2 Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting 0.4%
  • CVE-2024-13445 Medium 6.4 Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-10453 Medium 6.4 Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings 0.3%
  • CVE-2024-8236 Medium 6.4 Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-10788 High 7.2 Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context 0.8%
  • CVE-2024-6757 Medium 4.3 Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function 0.4%
  • CVE-2024-5416 Medium 5.4 Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets 0.4%
  • CVE-2024-4619 Medium 6.4 Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.4%
  • CVE-2024-2117 Medium 6.4 Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget 0.5%
  • CVE-2024-0506 Medium 6.4 Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt 0.5%
  • CVE-2020-36703 Medium 6.4 Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting 0.5%
  • CVE-2022-1329 High 8.8 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution 92.7%