Plugin security history

Elementor Website Builder – more than just a page builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 53 vulnerability records associated with Elementor Website Builder – more than just a page builder, published between 2017 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

53Total records

0Critical

6High

47Medium

0Low

0Informational

53Patched records

0Currently marked unpatched

2017-11-27First disclosure

2026-06-29Latest disclosure

51 of 53CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2017	1	1 records
2019	1	1 records
2020	10	10 records
2021	7	7 records
2022	2	2 records
2023	7	7 records
2024	9	9 records
2025	8	8 records
2026	8	8 records

Severity Breakdown

Severity	Records	Share
High	6	11.3%
Medium	47	88.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

35 records66%

First: 2020. Latest: 2026.

Missing Authorization

10 records18.9%

First: 2017. Latest: 2026.

Information Disclosure

3 records5.7%

First: 2024. Latest: 2026.

Path Traversal

2 records3.8%

First: 2024. Latest: 2025.

SQL Injection

1 record1.9%

First: 2023. Latest: 2023.

Other

1 record1.9%

First: 2023. Latest: 2023.

Arbitrary File Upload

1 record1.9%

First: 2023. Latest: 2023.

Patch Status

Patched: 53
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.1.4
4.1.1
4.0.5
3.35.6
3.35.8
3.33.4
3.33.1
3.30.3
3.29.1
3.25.11
3.27.5
3.25.10
3.25.8
3.24.6
3.24.0
3.22.2
3.21.6
3.20.3
3.19.1
3.19.0
3.18.2
3.16.5
3.5.5
3.13.3
3.13.2
3.12.2
3.5.6
3.6.3
3.4.8
3.1.4
3.0.14
2.9.14
2.9.9
2.9.8
2.9.6
2.9.3
2.8.5
2.7.6
2.8.4
2.7.5
1.8.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.1.3`	Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure	June 29, 2026	4.1.4	Medium
`*-4.1.3`	Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure	June 25, 2026	4.1.4	Medium
`*-4.1.0`	Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization	June 2, 2026	4.1.1	Medium
`*-4.0.4`	Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API	April 30, 2026	4.0.5	Medium
`*-3.35.5`	Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API	April 7, 2026	3.35.6	Medium
`*-3.35.7`	Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template	March 25, 2026	3.35.8	Medium
`*-3.35.5`	Elementor Website Builder <= 3.35.5 - Missing Authorization	March 7, 2026	3.35.6	Medium
`*-3.35.5`	Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 13, 2026	3.35.6	Medium
`*-3.33.3`	Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path	December 15, 2025	3.33.4	Medium
`*-3.33.0`	Elementor Website Builder <= 3.33.0 - Missing Authorization	November 25, 2025	3.33.1	Medium
`*-3.30.2`	Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import	August 11, 2025	3.30.3	Medium
`*-3.30.2`	Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget	July 28, 2025	3.30.3	Medium
`*-3.29.0`	Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 28, 2025	3.29.1	Medium
`*-3.29.0`	Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 19, 2025	3.29.1	Medium
`*-3.25.10`	Elementor Website Builder <= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 24, 2025	3.25.11	Medium
`*-3.27.4`	Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 19, 2025	3.27.5	Medium
`*-3.25.9`	Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings	December 20, 2024	3.25.10	Medium
`*-3.25.7`	Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 25, 2024	3.25.8	Medium
`*-3.24.5`	Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function	October 14, 2024	3.24.6	Medium
`*-3.23.4`	Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets	September 10, 2024	3.24.0	Medium
`*-3.22.1`	Elementor Website Builder <= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download	June 28, 2024	3.22.2	Medium
`*-3.21.5`	Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 20, 2024	3.21.6	Medium
`*-3.20.2`	Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget	March 26, 2024	3.20.3	Medium
`*-3.19.0`	Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization	February 7, 2024	3.19.1	High
`*-3.18.3`	Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt	February 7, 2024	3.19.0	Medium

Selected source records

Latest Records

MediumCVE-2026-8825

Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure

Published: June 29, 2026

Affected versions: *-4.1.3
Patched versions: 4.1.4

Original Wordfence record

MediumCVE-2026-57619

Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure

Published: June 25, 2026

Affected versions: *-4.1.3
Patched versions: 4.1.4

Original Wordfence record

MediumCVE-2026-49782

Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization

Published: June 2, 2026

Affected versions: *-4.1.0
Patched versions: 4.1.1

Original Wordfence record

MediumCVE-2026-6127

Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

Published: April 30, 2026

Affected versions: *-4.0.4
Patched versions: 4.0.5

Original Wordfence record

MediumCVE-2025-14732

Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

Published: April 7, 2026

Affected versions: *-3.35.5
Patched versions: 3.35.6

Original Wordfence record

MediumCVE-2026-1206

Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

Published: March 25, 2026

Affected versions: *-3.35.7
Patched versions: 3.35.8

Original Wordfence record

MediumCVE-2026-32445

Elementor Website Builder <= 3.35.5 - Missing Authorization

Published: March 7, 2026

Affected versions: *-3.35.5
Patched versions: 3.35.6

Original Wordfence record

MediumCVE-2026-32352

Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 13, 2026

Affected versions: *-3.35.5
Patched versions: 3.35.6

Original Wordfence record

Highest-Severity Records

HighCVE-2024-24934

Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization

Published: February 7, 2024

Affected versions: *-3.19.0
Patched versions: 3.19.1

Original Wordfence record

HighCVE-2023-48777

Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import

Published: December 6, 2023

Affected versions: *-3.18.1
Patched versions: 3.18.2

Original Wordfence record

HighCVE-2022-1329

Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

Published: April 13, 2022

Affected versions: 3.6.0-3.6.2
Patched versions: 3.6.3

Original Wordfence record

HighCVE-2017-18596

Elementor Website Builder <= 1.7.12 - Missing Authorization

Published: November 27, 2017

Affected versions: *-1.7.12
Patched versions: 1.8.0

Original Wordfence record

HighCVE-2020-7055

Elementor Website Builder <= 2.7.4 - Arbitrary File Upload

Published: October 28, 2019

Affected versions: [*, 2.7.5)
Patched versions: 2.7.5

Original Wordfence record

HighCVE-2020-7109

Elementor Website Builder <= 2.8.3 - Cross-Site Scripting

Published: January 19, 2020

Affected versions: *-2.8.3
Patched versions: 2.8.4

Original Wordfence record

MediumCVE-2023-0329

Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'

Published: April 24, 2023

Affected versions: [*, 3.12.2)
Patched versions: 3.12.2

Original Wordfence record

MediumCVE-2020-20634

Elementor Website Builder <= 2.9.5 - Authorization Bypass

Published: March 31, 2020

Affected versions: *-2.9.5
Patched versions: 2.9.6

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory