Elementor Website Builder – more than just a page builder

Vulnerabilities 61Slug elementorLatest version 4.0.7WordPress.org →

Minimum safe version

4.0.5

Update to 4.0.5 or later to address 60 fixable vulnerabilities

Latest available4.0.7 ✓Affected up to3.6.2 ⚠
N/A
2026-03-25< 3.35.8

Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

WordfenceCVE
Medium 4.9
2025-08-12< 3.30.3

Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

EUVDWordfenceCVE
Medium 6.4
2025-07-29< 3.29.1

Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

EUVDWordfenceCVE
Medium 6.4
2025-07-29< 3.30.3

Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

EUVDWordfenceCVE
Medium 6.4
2024-12-23< 3.25.10

WordPress Elementor Website Builder Plugin <= 3.25.9 is vulnerable to Cross Site Scripting (XSS)

PatchstackCVEWordfence
N/A
< 3.13.2

Elementor Website Builder &lt; 3.13.2 - Missing Authorization

WPScan
Medium 6.4
2023-06-07< 2.9.8

CVE-2020-36703

CVE
High 7.2
2023-05-30< 3.12.2

CVE-2023-0329

CVEWPScan
N/A
2023-05-12< 3.13.2

WordPress Elementor Website Builder Plugin <= 3.13.1 is vulnerable to Broken Access Control

Patchstack
N/A
2023-05-12< 3.13.2

Elementor <= 3.13.1 - Missing Authorization to Settings Update

Wordfence
N/A
2023-04-24< 3.12.2

WordPress Elementor Website Builder Plugin <= 3.12.1 is vulnerable to SQL Injection

Patchstack
N/A
2023-04-24< 3.12.2

Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'

Wordfence
N/A
< 2.7.7

Elementor Page Builder &lt; 2.7.6 - Authenticated Stored XSS

WPScan
N/A
< 2.9.8

Elementor &lt; 2.9.8 - SVG Sanitizer Bypass leading to Authenticated Stored XSS

WPScan
N/A
2020-01-29< 2.7.6

Elementor Website Builder <= 2.7.5 - Stored Cross-Site Scripting

Wordfence
N/A
2020-04-21< 2.9.8

Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting

Wordfence
N/A
2017-12-02< 1.8.8

WordPress Elementor Page Builder <=1.8.7 - Potential Privilege Escalation vulnerability

Patchstack
N/A
2017-12-02< 1.8.0

WordPress Elementor Page Builder <=1.7.12 - Authenticated Unrestricted Editing vulnerability

Patchstack
N/A
2020-01-29< 2.7.6

WordPress Elementor Page Builder plugin <= 2.7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2021-03-17< 3.1.4

WordPress Elementor Website Builder plugin <= 3.1.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Patchstack
Medium 5.4
2020-01-30< 2.8.5

WordPress Elementor Page Builder plugin <= 2.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

PatchstackWordfenceCVEWPScan
Medium 5.4
2020-09-02< 2.9.14

WordPress Elementor Website Builder plugin <= 2.9.13 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

PatchstackCVEWordfenceWPScan