Elementor Website Builder Pro

Elementor Website Builder Pro has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; all 17 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 9.9 out of 10. Severity breakdown: 2 critical and 2 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 10 of the records (59%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.

Every one of the 17 issues recorded for Elementor Website Builder Pro has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (6) reported by wesley (wcraft).

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Elementor Website Builder Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.9CVE-2020-13126

Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

17 records


2026-08-19 19:18	Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass Elementor Website Builder Pro <= 4.2.1	`CVE-2026-32475`	9.8 Critical	Tin Pham (TF1T)	Yes
2025-06-19 00:00	Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Elementor Website Builder Pro <= 3.29.0	`CVE-2024-50555`	6.4 Medium	Bonds	Yes
2025-06-09 16:22	Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Elementor Website Builder Pro <= 3.29.0	`CVE-2025-3076`	6.4 Medium	Tonn	Yes
2025-01-29 00:00	Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode Elementor Website Builder Pro <= 3.25.10	`CVE-2024-8494`	4.3 Medium	Ankit Patel	Yes
2024-06-28 00:00	Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting Elementor Website Builder Pro <= 3.21.2	`CVE-2024-35656`	6.1 Medium	Michael	Yes
2024-05-02 00:00	Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Elementor Website Builder Pro <= 3.21.0	`CVE-2024-4107`	6.4 Medium	wesley (wcraft)	Yes
2024-03-26 00:00	Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload Elementor Website Builder Pro <= 3.20.1	`CVE-2024-1521`	6.4 Medium	wesley (wcraft)	Yes
2024-03-26 00:00	Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Elementor Website Builder Pro <= 3.20.1	`CVE-2024-2120`	5.4 Medium	wesley (wcraft)	Yes
2024-03-26 00:00	Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Elementor Website Builder Pro <= 3.20.1	`CVE-2024-2121`	5.4 Medium	wesley (wcraft)	Yes
2024-03-26 00:00	Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag Elementor Website Builder Pro <= 3.20.1	`CVE-2024-2781`	6.4 Medium	wesley (wcraft)	Yes

Showing 1–10 of 17 reports