ElementorCVEs & Vulnerabilities

53 CVEs affecting Elementor products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

53 CVEs→ All vendors

Most Affected Products

website builder 37elementor page builder 8elementor pro 7site mailer 1

CVE-2020-7055CRITICAL

An issue was discovered in Elementor 2.7.4. Arbitrary file upload is possible in the Elementor Import Templates function, allowing an attacker to execute code via a crafted ZIP archive.

The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.

29 Jan 2020

5.4

CVSS

CVE-2020-7109CRITICAL

The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.

The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.

7 Oct 2019

6.1