Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Elementor Website Builder – more than just a page builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 53 vulnerability records associated with Elementor Website Builder – more than just a page builder, published between 2017 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

53Total records
0Critical
6High
47Medium
0Low
0Informational
53Patched records
0Currently marked unpatched
2017-11-27First disclosure
2026-06-29Latest disclosure
51 of 53CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201711 records
201911 records
20201010 records
202177 records
202222 records
202377 records
202499 records
202588 records
202688 records

Severity Breakdown

SeverityRecordsShare
High611.3%
Medium4788.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

35 records66%

First: 2020. Latest: 2026.

Missing Authorization

10 records18.9%

First: 2017. Latest: 2026.

Information Disclosure

3 records5.7%

First: 2024. Latest: 2026.

Path Traversal

2 records3.8%

First: 2024. Latest: 2025.

SQL Injection

1 record1.9%

First: 2023. Latest: 2023.

Other

1 record1.9%

First: 2023. Latest: 2023.

Arbitrary File Upload

1 record1.9%

First: 2023. Latest: 2023.

Patch Status

Patched
53
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 4.1.4
  • 4.1.1
  • 4.0.5
  • 3.35.6
  • 3.35.8
  • 3.33.4
  • 3.33.1
  • 3.30.3
  • 3.29.1
  • 3.25.11
  • 3.27.5
  • 3.25.10
  • 3.25.8
  • 3.24.6
  • 3.24.0
  • 3.22.2
  • 3.21.6
  • 3.20.3
  • 3.19.1
  • 3.19.0
  • 3.18.2
  • 3.16.5
  • 3.5.5
  • 3.13.3
  • 3.13.2
  • 3.12.2
  • 3.5.6
  • 3.6.3
  • 3.4.8
  • 3.1.4
  • 3.0.14
  • 2.9.14
  • 2.9.9
  • 2.9.8
  • 2.9.6
  • 2.9.3
  • 2.8.5
  • 2.7.6
  • 2.8.4
  • 2.7.5
  • 1.8.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-3.18.1Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template ImportDecember 6, 20233.18.2High
*-3.16.4Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment ReadNovember 8, 20233.16.5Medium
*-3.16.4Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()November 8, 20233.16.5Medium
*-3.5.4Elementor <= 3.5.4 - DOM-Based iFrame InjectionJuly 19, 20233.5.5Medium
[*, 3.13.3)Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_itemMay 22, 20233.13.3Medium
*-3.13.1Elementor <= 3.13.1 - Missing Authorization to Settings UpdateMay 12, 20233.13.2Medium
[*, 3.12.2)Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'April 24, 20233.12.2Medium
*-3.5.5Elementor Website Builder <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site ScriptingJune 13, 20223.5.6Medium
3.6.0-3.6.2Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code ExecutionApril 13, 20223.6.3High
0.1.0-3.4.7Elementor Website Builder <= 3.4.7 - DOM-based Cross-Site ScriptingMarch 23, 20213.4.8Medium
0.1.0-3.1.3Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tagMarch 17, 20213.1.4Medium
0.1.0-3.1.3Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_sizeMarch 17, 20213.1.4Medium
[*, 3.1.4)Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size ParameterMarch 17, 20213.1.4Medium
0.1.0-3.1.3Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tagMarch 17, 20213.1.4Medium
0.1.0-3.1.3Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_sizeMarch 17, 20213.1.4Medium
*-3.1.3Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tagMarch 17, 20213.1.4Medium
*-3.0.13Elementor Website Builder <= 3.0.13 - Unrestricted SVG UploadsNovember 25, 20203.0.14Medium
[*, 2.9.14)Elementor Website Builder <= 2.9.13 - Authenticated Stored Cross-Site ScriptingJuly 7, 20202.9.14Medium
*-2.9.8Elementor Website Builder <= 2.9.8 - Stored Cross-Site ScriptingJune 5, 20202.9.9Medium
*-2.9.8Elementor Website Builder <= 2.9.8 - Stored Cross-Site ScriptingJune 5, 20202.9.9Medium
*-2.9.7Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site ScriptingApril 21, 20202.9.8Medium
*-2.9.5Elementor Website Builder <= 2.9.5 - Authorization BypassMarch 31, 20202.9.6Medium
*-2.9.2Elementor Website Builder <= 2.9.2 - Stored Cross-Site ScriptingFebruary 26, 20202.9.3Medium
*-2.8.4Elementor Website Builder <= 2.8.4 - Reflected Cross-Site ScriptingJanuary 29, 20202.8.5Medium
*-2.7.5Elementor Website Builder <= 2.7.5 - Stored Cross-Site ScriptingJanuary 29, 20202.7.6Medium

Selected source records

Latest Records

MediumCVE-2026-8825

Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure

Published: June 29, 2026

Affected versions
*-4.1.3
Patched versions
4.1.4
Original Wordfence record
MediumCVE-2026-57619

Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure

Published: June 25, 2026

Affected versions
*-4.1.3
Patched versions
4.1.4
Original Wordfence record
MediumCVE-2026-49782

Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization

Published: June 2, 2026

Affected versions
*-4.1.0
Patched versions
4.1.1
Original Wordfence record
MediumCVE-2026-6127

Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

Published: April 30, 2026

Affected versions
*-4.0.4
Patched versions
4.0.5
Original Wordfence record
MediumCVE-2025-14732

Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

Published: April 7, 2026

Affected versions
*-3.35.5
Patched versions
3.35.6
Original Wordfence record
MediumCVE-2026-1206

Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

Published: March 25, 2026

Affected versions
*-3.35.7
Patched versions
3.35.8
Original Wordfence record
MediumCVE-2026-32445

Elementor Website Builder <= 3.35.5 - Missing Authorization

Published: March 7, 2026

Affected versions
*-3.35.5
Patched versions
3.35.6
Original Wordfence record
MediumCVE-2026-32352

Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 13, 2026

Affected versions
*-3.35.5
Patched versions
3.35.6
Original Wordfence record

Highest-Severity Records

HighCVE-2024-24934

Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization

Published: February 7, 2024

Affected versions
*-3.19.0
Patched versions
3.19.1
Original Wordfence record
HighCVE-2023-48777

Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import

Published: December 6, 2023

Affected versions
*-3.18.1
Patched versions
3.18.2
Original Wordfence record
HighCVE-2022-1329

Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

Published: April 13, 2022

Affected versions
3.6.0-3.6.2
Patched versions
3.6.3
Original Wordfence record
HighCVE-2017-18596

Elementor Website Builder <= 1.7.12 - Missing Authorization

Published: November 27, 2017

Affected versions
*-1.7.12
Patched versions
1.8.0
Original Wordfence record
HighCVE-2020-7055

Elementor Website Builder <= 2.7.4 - Arbitrary File Upload

Published: October 28, 2019

Affected versions
[*, 2.7.5)
Patched versions
2.7.5
Original Wordfence record
HighCVE-2020-7109

Elementor Website Builder <= 2.8.3 - Cross-Site Scripting

Published: January 19, 2020

Affected versions
*-2.8.3
Patched versions
2.8.4
Original Wordfence record
MediumCVE-2023-0329

Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'

Published: April 24, 2023

Affected versions
[*, 3.12.2)
Patched versions
3.12.2
Original Wordfence record
MediumCVE-2020-20634

Elementor Website Builder <= 2.9.5 - Authorization Bypass

Published: March 31, 2020

Affected versions
*-2.9.5
Patched versions
2.9.6
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory