Cross-Site Scripting
35 records66%First: 2020. Latest: 2026.
Plugin security history
Elementor Website Builder – more than just a page builder Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 53 vulnerability records associated with Elementor Website Builder – more than just a page builder, published between 2017 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
53Total records
0Critical
6High
47Medium
0Low
0Informational
53Patched records
0Currently marked unpatched
2017-11-27First disclosure
2026-06-29Latest disclosure
51 of 53CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2017 | 1 | |
| 2019 | 1 | |
| 2020 | 10 | |
| 2021 | 7 | |
| 2022 | 2 | |
| 2023 | 7 | |
| 2024 | 9 | |
| 2025 | 8 | |
| 2026 | 8 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| High | 6 | 11.3% |
| Medium | 47 | 88.7% |
Vulnerability-Type Breakdown
Missing Authorization
10 records18.9%First: 2017. Latest: 2026.
Information Disclosure
3 records5.7%First: 2024. Latest: 2026.
Path Traversal
2 records3.8%First: 2024. Latest: 2025.
SQL Injection
1 record1.9%First: 2023. Latest: 2023.
Other
1 record1.9%First: 2023. Latest: 2023.
Arbitrary File Upload
1 record1.9%First: 2023. Latest: 2023.
Patch Status
- Patched
- 53
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
4.1.44.1.14.0.53.35.63.35.83.33.43.33.13.30.33.29.13.25.113.27.53.25.103.25.83.24.63.24.03.22.23.21.63.20.33.19.13.19.03.18.23.16.53.5.53.13.33.13.23.12.23.5.63.6.33.4.83.1.43.0.142.9.142.9.92.9.82.9.62.9.32.8.52.7.62.8.42.7.51.8.0
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-2.8.3 | Elementor Website Builder <= 2.8.3 - Cross-Site Scripting | January 19, 2020 | 2.8.4 | High |
[*, 2.7.5) | Elementor Website Builder <= 2.7.4 - Arbitrary File Upload | October 28, 2019 | 2.7.5 | High |
*-1.7.12 | Elementor Website Builder <= 1.7.12 - Missing Authorization | November 27, 2017 | 1.8.0 | High |
Selected source records
Latest Records
MediumCVE-2026-8825
Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
Published: June 29, 2026
- Affected versions
- *-4.1.3
- Patched versions
- 4.1.4
MediumCVE-2026-57619
Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
Published: June 25, 2026
- Affected versions
- *-4.1.3
- Patched versions
- 4.1.4
MediumCVE-2026-49782
Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization
Published: June 2, 2026
- Affected versions
- *-4.1.0
- Patched versions
- 4.1.1
MediumCVE-2026-6127
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Published: April 30, 2026
- Affected versions
- *-4.0.4
- Patched versions
- 4.0.5
MediumCVE-2025-14732
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Published: April 7, 2026
- Affected versions
- *-3.35.5
- Patched versions
- 3.35.6
MediumCVE-2026-1206
Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Published: March 25, 2026
- Affected versions
- *-3.35.7
- Patched versions
- 3.35.8
MediumCVE-2026-32445
Elementor Website Builder <= 3.35.5 - Missing Authorization
Published: March 7, 2026
- Affected versions
- *-3.35.5
- Patched versions
- 3.35.6
MediumCVE-2026-32352
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: February 13, 2026
- Affected versions
- *-3.35.5
- Patched versions
- 3.35.6
Highest-Severity Records
HighCVE-2024-24934
Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
Published: February 7, 2024
- Affected versions
- *-3.19.0
- Patched versions
- 3.19.1
HighCVE-2023-48777
Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
Published: December 6, 2023
- Affected versions
- *-3.18.1
- Patched versions
- 3.18.2
HighCVE-2022-1329
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
Published: April 13, 2022
- Affected versions
- 3.6.0-3.6.2
- Patched versions
- 3.6.3
HighCVE-2017-18596
Elementor Website Builder <= 1.7.12 - Missing Authorization
Published: November 27, 2017
- Affected versions
- *-1.7.12
- Patched versions
- 1.8.0
HighCVE-2020-7055
Elementor Website Builder <= 2.7.4 - Arbitrary File Upload
Published: October 28, 2019
- Affected versions
- [*, 2.7.5)
- Patched versions
- 2.7.5
HighCVE-2020-7109
Elementor Website Builder <= 2.8.3 - Cross-Site Scripting
Published: January 19, 2020
- Affected versions
- *-2.8.3
- Patched versions
- 2.8.4
MediumCVE-2023-0329
Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'
Published: April 24, 2023
- Affected versions
- [*, 3.12.2)
- Patched versions
- 3.12.2
MediumCVE-2020-20634
Elementor Website Builder <= 2.9.5 - Authorization Bypass
Published: March 31, 2020
- Affected versions
- *-2.9.5
- Patched versions
- 2.9.6
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.