Elementor Website Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:elementor_website_builder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Elementor Website Builder (16f1fb0d-0ed5-55f0-a791-d06ce0655442) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-0329 |
vulnerable | 2026-06-08 05:52:04.758793 |
Elementor Website Builder < 3.12.2 - Admin+ SQLi
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Published: 2023-05-30T07:49:13.896Z
Updated: 2025-04-23T16:21:31.797Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4953 |
vulnerable | 2026-06-08 05:52:02.296994 |
Elementor < 3.5.5 - Iframe Injection
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Published: 2023-08-14T19:10:18.365Z
Updated: 2024-08-03T01:55:46.165Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24891 |
vulnerable | 2026-06-08 05:30:39.566116 |
Elementor < 3.4.8 - DOM Cross-Site-Scripting
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
Published: 2021-11-23T19:16:21.000Z
Updated: 2024-08-03T19:49:14.369Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24206 |
vulnerable | 2026-06-08 05:30:03.956629 |
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Published: 2021-04-05T18:27:46.000Z
Updated: 2024-08-03T19:21:18.814Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24205 |
vulnerable | 2026-06-08 05:30:03.956209 |
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Published: 2021-04-05T18:27:46.000Z
Updated: 2024-08-03T19:21:18.691Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24204 |
vulnerable | 2026-06-08 05:30:03.955886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24203 |
vulnerable | 2026-06-08 05:30:03.955560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24202 |
vulnerable | 2026-06-08 05:30:03.955204 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24201 |
vulnerable | 2026-06-08 05:30:03.953947 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.