Elementor Website Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:elementor_website_builder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Elementor Website Builder (16f1fb0d-0ed5-55f0-a791-d06ce0655442) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-8825 |
vulnerable | 2026-07-29 01:09:06.298357 |
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Published: 2026-07-20T06:00:05.303Z
Updated: 2026-07-20T13:09:48.210Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0329 |
vulnerable | 2026-06-08 05:52:04.758793 |
Elementor Website Builder < 3.12.2 - Admin+ SQLi
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Published: 2023-05-30T07:49:13.896Z
Updated: 2025-04-23T16:21:31.797Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4953 |
vulnerable | 2026-06-08 05:52:02.296994 |
Elementor < 3.5.5 - Iframe Injection
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Published: 2023-08-14T19:10:18.365Z
Updated: 2024-08-03T01:55:46.165Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24891 |
vulnerable | 2026-06-08 05:30:39.566116 |
Elementor < 3.4.8 - DOM Cross-Site-Scripting
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
Published: 2021-11-23T19:16:21.000Z
Updated: 2024-08-03T19:49:14.369Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24206 |
vulnerable | 2026-06-08 05:30:03.956629 |
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Published: 2021-04-05T18:27:46.000Z
Updated: 2024-08-03T19:21:18.814Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24205 |
vulnerable | 2026-06-08 05:30:03.956209 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24204 |
vulnerable | 2026-06-08 05:30:03.955886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24203 |
vulnerable | 2026-06-08 05:30:03.955560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24202 |
vulnerable | 2026-06-08 05:30:03.955204 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24201 |
vulnerable | 2026-06-08 05:30:03.953947 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.