WordPress elementor has 16 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-1329 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capabili | high | 8.8 | >=3.6.0 and <=3.6.2 | – |
| CVE-2020-7109 | The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template. | critical | 9.8 | <2.8.4 | 2.8.4 |
| CVE-2017-18596 | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. | high | 8.8 | <1.8.0 | 1.8.0 |
| CVE-2020-8426 | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be e | medium | 5.4 | <2.8.5 | 2.8.5 |
| CVE-2020-36171 | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. | medium | 6.1 | <3.0.14 | 3.0.14 |
| CVE-2020-15020 | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name | medium | 5.4 | <=2.9.13 | – |
| CVE-2025-8081 | The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images:: | medium | 4.9 | <3.30.3 | 3.30.3 |
| CVE-2024-0506 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $ | medium | 6.4 | <3.19.0 | 3.19.0 |
| CVE-2024-2117 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | <3.20.3 | 3.20.3 |
| CVE-2024-4619 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting vi | medium | 6.4 | <3.21.5 | 3.21.5 |
| CVE-2024-6757 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versio | medium | 4.3 | <3.24.6 | 3.24.6 |
| CVE-2024-5416 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url | medium | 5.4 | <3.24.0 | 3.24.0 |
| CVE-2024-8236 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url | medium | 6.4 | <=3.25.7 | – |
| CVE-2024-10453 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | <=3.25.9 | – |
| CVE-2024-13445 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bord | medium | 6.4 | <3.27.5 | 3.27.5 |
| CVE-2025-3075 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug | medium | 6.4 | <3.29.1 | 3.29.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked