Elementor Pro
10 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Elementor Pro, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Elementor Pro CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 0 |
Severity
How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High3
- Medium6
Latest CVEs
The 10 most recently published vulnerabilities affecting Elementor Pro.
- CVE-2026-32475WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability9.0
- CVE-2024-35656WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2023-35050WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability5.4
- CVE-2024-1521Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload6.4
- CVE-2024-2781Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag6.4
- CVE-2024-2121Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4
- CVE-2024-1364Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting6.4
- CVE-2024-23523WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability6.5
- CVE-2023-3124Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option8.8
- CVE-2020-26596The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executab...8.8
Product grouping is registry-driven, with AI assist and human review. How it works