- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Elementor Website Builder recorded 4 security vulnerabilities in the last 90 days, of which 3 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Elementor Website Builder and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-120850WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-109884WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-109883WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-62062Cross-Site Request Forgery can trigger unauthorized actions in Elementor Website BuilderCVE-2026-57619Missing Authorization Exposes Sensitive Data in Elementor Website Builder| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-120850WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-109884WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-109883WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-62062Cross-Site Request Forgery can trigger unauthorized actions in Elementor Website Builder | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-57619Missing Authorization Exposes Sensitive Data in Elementor Website Builder | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-49782WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published06/02/2026 | SeverityMedium |
|---|
CVE-2026-32445WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published03/13/2026 | SeverityLow |
|---|
CVE-2026-32352WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published03/13/2026 | SeverityMedium |
|---|
CVE-2024-50555WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published02/20/2026 | SeverityMedium |
|---|
CVE-2025-67588WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityMedium |
|---|
CVE-2024-54444WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published02/25/2025 | SeverityMedium |
|---|
CVE-2024-37437WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability | Exploitation statusNot exploited | FixYes | Published07/09/2024 | SeverityMedium |
|---|
CVE-2023-33922WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published06/11/2024 | SeverityMedium |
|---|
CVE-2024-24934WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability | Exploitation statusNot exploited | FixYes | Published05/17/2024 | SeverityHigh |
|---|
CVE-2023-47504WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability | Exploitation statusNot exploited | FixYes | Published04/24/2024 | SeverityMedium |
|---|
15 Results | Page 1 of 1