Elementor Website Builder · Security record

Is Elementor Website Builder safe?

No known vulnerability affects the current version (4.3.6). 68 issues were found in earlier versions and fixed, the latest disclosed on Nov 6, 2026.

Checked today against the WPVulnerability database, for version 4.3.6.

How it’s looked after

Last release: Nov 2, 2026 (6 days ago)
Releases in the last year: 87
Tested up to: WordPress 7.1.4
Support resolved: 43 of 66 threads in two months
Active installs: 10M+

68 known vulnerabilities

3 critical
7 high
42 medium
1 low
15 not rated

None affects the current version.

Disclosed each year

20173
20191
202011
20218
20222
20239
20249
20258
202614

Every known vulnerability in Elementor Website Builder

Newest first, with any that affect the current version at the top.

high
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder e…
Fixed in 4.3.6 · CVE-2026-109883 · Nov 6, 2026 · CVE
high
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder e…
Fixed in 4.3.6 · CVE-2026-109884 · Nov 6, 2026 · CVE
Authenticated (Author+) Stored Cross-Site Scripting
Fixed in 4.3.5 · CVE-2026-81812 · Oct 19, 2026 · Wordfence
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 4.3.5 · CVE-2026-81813 · Oct 19, 2026 · Wordfence
medium
Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
Fixed in 4.2.4 · CVE-2026-11905 · Sep 25, 2026 · Wordfence
high
Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation
Fixed in 4.3.2 · CVE-2026-62062 · Jun 29, 2026 · Wordfence
Authenticated (Contributor+) Sensitive Information Exposure
Fixed in 4.1.4 · CVE-2026-8825 · Jun 29, 2026 · Wordfence
medium
Authenticated (Contributor+) Sensitive Information Exposure
Fixed in 4.1.4 · CVE-2026-57619 · Jun 25, 2026 · Wordfence
medium
Missing Authorization
Fixed in 4.1.1 · CVE-2026-49782 · Jun 2, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Fixed in 4.0.5 · CVE-2026-6127 · Apr 30, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Fixed in 3.35.6 · CVE-2025-14732 · Apr 7, 2026 · Wordfence
Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Fixed in 3.35.8 · CVE-2026-1206 · Mar 25, 2026 · Wordfence
low
Missing Authorization
Fixed in 3.35.6 · CVE-2026-32445 · Mar 7, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.35.6 · CVE-2026-32352 · Feb 13, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path
Fixed in 3.33.4 · CVE-2025-11220 · Dec 15, 2025 · Wordfence
medium
Missing Authorization
Fixed in 3.33.1 · CVE-2025-67588 · Nov 25, 2025 · Wordfence
medium
Authenticated (Administrator+) Arbitrary File Read via Image Import
Fixed in 3.30.3 · CVE-2025-8081 · Aug 11, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.29.1 · CVE-2025-3075 · Jul 28, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget
Fixed in 3.30.3 · CVE-2025-4566 · Jul 28, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.29.1 · CVE-2024-50555 · Jun 19, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.25.11 · CVE-2024-54444 · Feb 24, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.27.5 · CVE-2024-13445 · Feb 19, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings
Fixed in 3.25.10 · CVE-2024-10453 · Dec 20, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.25.8 · CVE-2024-8236 · Nov 25, 2024 · Wordfence
medium
Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function
Fixed in 3.24.6 · CVE-2024-6757 · Oct 14, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
Fixed in 3.24.0 · CVE-2024-5416 · Sep 10, 2024 · Wordfence
medium
Authenticated (Contributor+) Arbitrary SVG Download
Fixed in 3.22.2 · CVE-2024-37437 · Jun 28, 2024 · Wordfence
medium
Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in 3.22.0-beta2 · CVE-2024-4619 · May 20, 2024 · Wordfence
medium
Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget
Fixed in 3.20.3 · CVE-2024-2117 · Mar 26, 2024 · Wordfence
high
Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
Fixed in 3.19.1 · CVE-2024-24934 · Feb 7, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
Fixed in 3.19.0 · CVE-2024-0506 · Feb 7, 2024 · Wordfence
critical
Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
Fixed in 3.18.2 · CVE-2023-48777 · Dec 6, 2023 · Wordfence
medium
Missing Authorization to Arbitrary Attachment Read
Fixed in 3.16.5 · CVE-2023-47504 · Nov 8, 2023 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
Fixed in 3.16.5 · CVE-2023-47505 · Nov 8, 2023 · Wordfence
medium
DOM-Based iFrame Injection
Fixed in 3.5.5 · CVE-2022-4953 · Jul 19, 2023 · Wordfence
medium
Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item
Fixed in 3.13.3 · CVE-2023-33922 · May 22, 2023 · Wordfence
WordPress Elementor Website Builder Plugin <= 3.13.1 is vulnerable to Broken Access Control
Fixed in 3.13.2 · May 12, 2023 · Patchstack
Missing Authorization to Settings Update
Fixed in 3.13.2 · May 12, 2023 · Wordfence
WordPress Elementor Website Builder Plugin <= 3.12.1 is vulnerable to SQL Injection
Fixed in 3.12.2 · Apr 24, 2023 · Patchstack
high
Authenticated(Administrator+) SQL Injection via 'replace_urls'
Fixed in 3.12.2 · CVE-2023-0329 · Apr 24, 2023 · Wordfence
medium
Unauthenticated DOM-based Reflected Cross-Site Scripting
Fixed in 3.5.6 · CVE-2022-29455 · Jun 13, 2022 · Wordfence
high
Missing Authorization to Remote Code Execution
Affects 3.6.2 and earlier · CVE-2022-1329 · Apr 13, 2022 · Wordfence
medium
DOM-based Cross-Site Scripting
Fixed in 3.6.3 · CVE-2021-24891 · Mar 23, 2021 · Wordfence
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Fixed in 3.1.4 · Mar 17, 2021 · Patchstack
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
Fixed in 3.1.4 · CVE-2021-24201 · Mar 17, 2021 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via title_size
Fixed in 3.1.4 · CVE-2021-24206 · Mar 17, 2021 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter
Fixed in 3.1.4 · CVE-2021-24205 · Mar 17, 2021 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag
Fixed in 3.1.4 · CVE-2021-24204 · Mar 17, 2021 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
Fixed in 3.1.4 · CVE-2021-24203 · Mar 17, 2021 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via header_size
Fixed in 3.1.4 · CVE-2021-24202 · Mar 17, 2021 · Wordfence
medium
Unrestricted SVG Uploads
Fixed in 3.0.14 · CVE-2020-36171 · Nov 25, 2020 · Wordfence
medium
Authenticated Stored Cross-Site Scripting
Fixed in 2.9.14 · CVE-2020-15020 · Jul 7, 2020 · Wordfence
medium
Stored Cross-Site Scripting
Fixed in 2.9.10 · CVE-2020-13865 · Jun 5, 2020 · Wordfence
medium
Stored Cross-Site Scripting
Fixed in 2.9.9 · CVE-2020-13864 · Jun 5, 2020 · Wordfence
medium
Authenticated Stored Cross-Site Scripting
Fixed in 2.9.8 · CVE-2020-36703 · Apr 21, 2020 · Wordfence
medium
Authorization Bypass
Fixed in 2.9.6 · CVE-2020-20634 · Mar 31, 2020 · Wordfence
medium
Stored Cross-Site Scripting
Fixed in 2.9.3 · CVE-2020-20406 · Feb 26, 2020 · Wordfence
Stored Cross-Site Scripting
Fixed in 2.7.6 · Jan 29, 2020 · Wordfence
Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Fixed in 2.7.6 · Jan 29, 2020 · Patchstack
medium
Reflected Cross-Site Scripting
Fixed in 2.8.5 · CVE-2020-8426 · Jan 28, 2020 · Wordfence
critical
Cross-Site Scripting
Fixed in 2.8.4 · CVE-2020-7109 · Jan 19, 2020 · Wordfence
critical
Arbitrary File Upload
Fixed in 2.7.5 · CVE-2020-7055 · Oct 28, 2019 · Wordfence
Potential Privilege Escalation vulnerability
Fixed in 1.8.8 · Dec 2, 2017 · Patchstack
Authenticated Unrestricted Editing vulnerability
Fixed in 1.8.0 · Dec 2, 2017 · Patchstack
high
Missing Authorization
Fixed in 1.8.0 · CVE-2017-18596 · Nov 27, 2017 · Wordfence
Missing Authorization
Fixed in 3.13.2 · WPScan
Authenticated Stored XSS
Fixed in 2.7.7 · WPScan
SVG Sanitizer Bypass leading to Authenticated Stored XSS
Fixed in 2.9.8 · WPScan

Questions about Elementor Website Builder’s security

Is Elementor Website Builder safe to use?

No known vulnerability affects its current version. Earlier versions had issues that are now fixed, so keep Elementor Website Builder updated: most attacks target sites that haven’t updated.

Does Elementor Website Builder have known security vulnerabilities?

None that affect the current version. WPVulnerability’s database lists 68 older issues, fixed in earlier versions, so keep Elementor Website Builder up to date.

Is Elementor Website Builder still maintained?

Yes. Its last release was 6 days ago. Its authors resolved 43 of the 66 support threads opened in the last two months.

Is Elementor Website Builder compatible with the latest WordPress?

Yes. It’s tested up to WordPress 7.1.4, the current version.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.