Elementor Website Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:elementor_website_builder:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Elementor Website Builder (16f1fb0d-0ed5-55f0-a791-d06ce0655442) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-81813 |
vulnerable | 2026-11-03 10:15:36.584023 |
Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
Published: 2026-10-21T06:00:24.425Z
Updated: 2026-10-21T10:35:02.168Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81812 |
vulnerable | 2026-11-03 10:15:36.532558 |
Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
Published: 2026-10-21T06:00:24.247Z
Updated: 2026-10-21T10:35:02.313Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8825 |
vulnerable | 2026-07-29 01:09:06.298357 |
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Published: 2026-07-20T06:00:05.303Z
Updated: 2026-07-20T13:09:48.210Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0329 |
vulnerable | 2026-06-08 05:52:04.758793 |
Elementor Website Builder < 3.12.2 - Admin+ SQLi
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Published: 2023-05-30T07:49:13.896Z
Updated: 2025-04-23T16:21:31.797Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4953 |
vulnerable | 2026-06-08 05:52:02.296994 |
Elementor < 3.5.5 - Iframe Injection
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Published: 2023-08-14T19:10:18.365Z
Updated: 2024-08-03T01:55:46.165Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24891 |
vulnerable | 2026-06-08 05:30:39.566116 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24206 |
vulnerable | 2026-06-08 05:30:03.956629 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24205 |
vulnerable | 2026-06-08 05:30:03.956209 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24204 |
vulnerable | 2026-06-08 05:30:03.955886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24203 |
vulnerable | 2026-06-08 05:30:03.955560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24202 |
vulnerable | 2026-06-08 05:30:03.955204 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24201 |
vulnerable | 2026-06-08 05:30:03.953947 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.