elemntor vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20248
4. 20257
5. 20268

Newest CVEs

• CVE-2026-11905

  Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters

  elemntor · Elementor Website Builder – more than just a page builder

  Medium4.3
• CVE-2026-5727

  Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site

  elemntor · Hello Plus

  Medium5.4
• CVE-2026-5821

  Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

  elemntor · Image Optimizer – Compress Images and Convert to WebP or AVIF

  High8.1
• CVE-2026-7567

  Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

  elemntor · Temporary Login

  Critical9.8
• CVE-2026-6127

  Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

  elemntor · Elementor Website Builder – more than just a page builder

  Medium6.4
• CVE-2025-14732

  Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API

  elemntor · Elementor Website Builder – more than just a page builder

  Medium6.4
• CVE-2026-1206

  Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

  elemntor · Elementor Website Builder – more than just a page builder

  Medium4.3
• CVE-2026-2413

  Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path

  elemntor · Ally – Web Accessibility & Usability

  High7.5
• CVE-2025-11220

  Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path

  elemntor · Elementor Website Builder – more than just a page builder

  Medium6.4
• CVE-2025-10700

  Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update

  elemntor · Ally – Web Accessibility & Usability

  Medium4.3