Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 162

Export CSV
CVE-2026-109884

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress-extensions
Products
Elementor Website Builder Elementor Website Builder
CVE-2026-109883

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress-extensions
Products
Elementor Website Builder Elementor Website Builder
CVE-2026-120850

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress-extensions
Products
Elementor Website Builder Elementor Website Builder
CVE-2025-53230

WordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Elementor Wordpress
CVE-2026-62062

WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Website Builder Wordpress
CVE-2026-84759

WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Activity Log Wordpress
CVE-2026-32475

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.

CVSS 3.1 · 9 Critical EPSS 2.0% KEV · Not listed
Vendors
Elementor Wordpress
Products
Elementor Pro Wordpress
CVE-2026-8825

Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Elementor Website Builder Wordpress
CVE-2023-0329

Elementor Website Builder < 3.12.2 - Admin+ SQLi

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.

CVSS 3.1 · 7.2 High EPSS 19.7% KEV · Not listed
Vendors
Elementor
Products
Website Builder
CVE-2026-49782

WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Elementor Website Builder Wordpress
CVE-2025-67524

WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster Elementor Addon jobmonster-addon allows PHP Local File Inclusion.This issue affects Jobmonster Elementor Addon: from n/a through <= 1.1.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Elementor Nootheme Wordpress
Products
Elementor Jobmonster Wordpress
CVE-2025-46434

WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through < 6.3.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Posimyth Wordpress
Products
Elementor The Plus Addons For Elementor Wordpress
CVE-2023-35050

WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability

Missing Authorization vulnerability in Elementor Elementor Pro.This issue affects Elementor Pro: from n/a through 3.13.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Wordpress
Products
Elementor Pro Wordpress
CVE-2026-24386

WordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Invader – Template Kits for Elementor: from n/a through <= 1.2.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Elementinvader Elementor Wordpress
Products
Template Kits For Elementor Elementor Wordpress
CVE-2025-68981

WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Designthemes Elementor Wordpress
Products
Homefix Elementor Portfolio Elementor Wordpress
CVE-2025-63033

WordPress Make Section & Column Clickable For Elementor plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyadh Ahmed Make Section & Column Clickable For Elementor make-section-column-clickable-elementor allows Stored XSS.This issue affects Make Section & Column Clickable For Elementor: from n/a through <= 2.4.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Riyadh Ahmed Wordpress
Products
Elementor Make Section And Column Clickable For Elementor Wordpress
CVE-2025-60084

WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Add-ons.org Elementor Wordpress
Products
Pdf-for-elementor-forms Elementor Wordpress
CVE-2024-32681

WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Elementor
Products
Prime Slider Elementor
CVE-2023-48777

WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.

CVSS 3.1 · 9.9 Critical EPSS 4.1% KEV · Not listed
Vendors
Elementor
Products
Website Builder