WordPress website-builder has 14 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-24891 | The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, | medium | 6.1 | >1.5.0 and <3.1.4 or >=3.2.0 and <3.4.8 | 3.1.4, 3.4.8 |
| CVE-2023-0329 | The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools mo | high | 7.2 | <3.12.2 | 3.12.2 |
| CVE-2022-4953 | The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This co | medium | 6.1 | <3.5.5 | 3.5.5 |
| CVE-2020-20634 | Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable al | medium | 6.5 | <=2.9.5 | – |
| CVE-2021-24205 | In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ p | medium | 5.4 | <3.1.4 | 3.1.4 |
| CVE-2021-24201 | In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ para | medium | 5.4 | <3.1.4 | 3.1.4 |
| CVE-2021-24202 | In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ pa | medium | 5.4 | <3.1.4 | 3.1.4 |
| CVE-2021-24203 | In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ para | medium | 5.4 | <3.1.4 | 3.1.4 |
| CVE-2021-24204 | In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_ | medium | 5.4 | <3.1.4 | 3.1.4 |
| CVE-2021-24206 | In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ | medium | 5.4 | <3.1.4 | 3.1.4 |
| CVE-2020-36703 | The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and | medium | 6.4 | <=2.9.7 | – |
| CVE-2024-4107 | The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | <3.21.1 | 3.21.1 |
| CVE-2024-2120 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget | medium | 5.4 | <3.20.2 | 3.20.2 |
| CVE-2024-8494 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | <3.25.11 | 3.25.11 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked