Elementor Website Builder – more than just a page builder vulnerabilities
Plugin slug elementor · 61 known vulnerabilities · latest disclosed 2026-11-11 · WordPress.org page
Every listed vulnerability has a fix. Version 4.3.6 or later is not affected by any of them. If your site runs an older version, update it.
8 of 61 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Elementor Website Builder – more than just a page builder
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| Medium 6.4 | < 4.3.6 | 4.3.6 | CVE-2026-104718 | 2026-11-11 | Advisory |
| Medium 6.4 | <= 4.3.5 | 4.3.6 | CVE-2026-120850 | 2026-11-07 | Advisory |
| High 7.2 | <= 4.3.5 | 4.3.6 | CVE-2026-109883 | 2026-11-04 | Advisory |
| Medium 6.1 | <= 4.3.5 | 4.3.6 | CVE-2026-109884 | 2026-11-04 | Advisory |
| Medium 6.4 | <= 4.3.4 | 4.3.5 | CVE-2026-81812 | 2026-10-19 | Advisory |
| Medium 6.4 | <= 4.3.4 | 4.3.5 | CVE-2026-81813 | 2026-10-19 | Advisory |
| Medium 4.3 | <= 4.2.3 | 4.2.4 | CVE-2026-11905 | 2026-10-14 | Advisory |
| High 8.8 | 4.3.0 to 4.3.1 | 4.3.2 | CVE-2026-62062 | 2026-09-25 | Advisory |
| Medium 4.3 | <= 4.1.3 | 4.1.4 | CVE-2026-8825 | 2026-06-29 | Advisory |
| Medium 4.3 | <= 4.1.3 | 4.1.4 | CVE-2026-57619 | 2026-06-25 | Advisory |
| Medium 4.3 | <= 4.1.0 | 4.1.1 | CVE-2026-49782 | 2026-06-02 | Advisory |
| Medium 6.4 | <= 4.0.4 | 4.0.5 | CVE-2026-6127 | 2026-04-30 | Advisory |
| Medium 6.4 | <= 3.35.5 | 3.35.6 | CVE-2025-14732 | 2026-04-07 | Advisory |
| Medium 4.3 | <= 3.35.7 | 3.35.8 | CVE-2026-1206 | 2026-03-25 | Advisory |
| Medium 4.3 | <= 3.35.5 | 3.35.6 | CVE-2026-32445 | 2026-03-07 | Advisory |
| Medium 6.4 | <= 3.35.5 | 3.35.6 | CVE-2026-32352 | 2026-02-13 | Advisory |
| Medium 6.4 | <= 3.33.3 | 3.33.4 | CVE-2025-11220 | 2025-12-15 | Advisory |
| Medium 4.3 | <= 3.33.0 | 3.33.1 | CVE-2025-67588 | 2025-11-25 | Advisory |
| Medium 4.9 | <= 3.30.2 | 3.30.3 | CVE-2025-8081 | 2025-08-11 | Advisory |
| Medium 6.4 | <= 3.29.0 | 3.29.1 | CVE-2025-3075 | 2025-07-28 | Advisory |
| Medium 6.4 | <= 3.30.2 | 3.30.3 | CVE-2025-4566 | 2025-07-28 | Advisory |
| Medium 6.4 | <= 3.29.0 | 3.29.1 | CVE-2024-50555 | 2025-06-19 | Advisory |
| Medium 6.4 | <= 3.25.10 | 3.25.11 | CVE-2024-54444 | 2025-02-24 | Advisory |
| Medium 6.4 | <= 3.27.4 | 3.27.5 | CVE-2024-13445 | 2025-02-19 | Advisory |
| Medium 6.4 | <= 3.25.9 | 3.25.10 | CVE-2024-10453 | 2024-12-20 | Advisory |
| Medium 6.4 | <= 3.25.7 | 3.25.8 | CVE-2024-8236 | 2024-11-25 | Advisory |
| Medium 4.3 | <= 3.24.5 | 3.24.6 | CVE-2024-6757 | 2024-10-14 | Advisory |
| Medium 5.4 | <= 3.23.4 | 3.24.0 | CVE-2024-5416 | 2024-09-10 | Advisory |
| Medium 6.4 | <= 3.22.1 | 3.22.2 | CVE-2024-37437 | 2024-06-28 | Advisory |
| Medium 6.4 | <= 3.21.5 | 3.21.6 | CVE-2024-4619 | 2024-05-20 | Advisory |
| Medium 6.4 | <= 3.20.2 | 3.20.3 | CVE-2024-2117 | 2024-03-26 | Advisory |
| Medium 6.4 | <= 3.18.3 | 3.19.0 | CVE-2024-0506 | 2024-02-07 | Advisory |
| High 8.8 | <= 3.19.0 | 3.19.1 | CVE-2024-24934 | 2024-02-07 | Advisory |
| High 8.8 | <= 3.18.1 | 3.18.2 | CVE-2023-48777 | 2023-12-06 | Advisory |
| Medium 6.4 | <= 3.16.4 | 3.16.5 | CVE-2023-47505 | 2023-11-08 | Advisory |
| Medium 6.5 | <= 3.16.4 | 3.16.5 | CVE-2023-47504 | 2023-11-08 | Advisory |
| Medium 6.1 | <= 3.5.4 | 3.5.5 | CVE-2022-4953 | 2023-07-19 | Advisory |
| Medium 5.4 | < 3.13.3 | 3.13.3 | CVE-2023-33922 | 2023-05-22 | Advisory |
| Medium 5.4 | <= 3.13.1 | 3.13.2 | none | 2023-05-12 | Advisory |
| Medium 6.6 | < 3.12.2 | 3.12.2 | CVE-2023-0329 | 2023-04-24 | Advisory |
| Medium 6.1 | <= 3.5.5 | 3.5.6 | CVE-2022-29455 | 2022-06-13 | Advisory |
| High 8.8 | 3.6.0 to 3.6.2 | 3.6.3 | CVE-2022-1329 | 2022-04-13 | Advisory |
| Medium 6.1 | 0.1.0 to 3.4.7 | 3.4.8 | CVE-2021-24891 | 2021-03-23 | Advisory |
| Medium 6.4 | <= 3.1.3 | 3.1.4 | CVE-2021-24204 | 2021-03-17 | Advisory |
| Medium 6.4 | 0.1.0 to 3.1.3 | 3.1.4 | CVE-2021-24206 | 2021-03-17 | Advisory |
| Medium 6.4 | 0.1.0 to 3.1.3 | 3.1.4 | CVE-2021-24201 | 2021-03-17 | Advisory |
| Medium 6.4 | < 3.1.4 | 3.1.4 | CVE-2021-24205 | 2021-03-17 | Advisory |
| Medium 6.4 | 0.1.0 to 3.1.3 | 3.1.4 | CVE-2021-24202 | 2021-03-17 | Advisory |
| Medium 6.4 | 0.1.0 to 3.1.3 | 3.1.4 | CVE-2021-24203 | 2021-03-17 | Advisory |
| Medium 6.4 | <= 3.0.13 | 3.0.14 | CVE-2020-36171 | 2020-11-25 | Advisory |
| Medium 6.4 | < 2.9.14 | 2.9.14 | CVE-2020-15020 | 2020-07-07 | Advisory |
| Medium 5.4 | <= 2.9.8 | 2.9.9 | CVE-2020-13864 | 2020-06-05 | Advisory |
| Medium 5.4 | <= 2.9.8 | 2.9.9 | CVE-2020-13865 | 2020-06-05 | Advisory |
| Medium 6.4 | <= 2.9.7 | 2.9.8 | CVE-2020-36703 | 2020-04-21 | Advisory |
| Medium 6.5 | <= 2.9.5 | 2.9.6 | CVE-2020-20634 | 2020-03-31 | Advisory |
| Medium 6.4 | <= 2.9.2 | 2.9.3 | CVE-2020-20406 | 2020-02-26 | Advisory |
| Medium 6.4 | <= 2.7.5 | 2.7.6 | none | 2020-01-29 | Advisory |
| Medium 6.1 | <= 2.8.4 | 2.8.5 | CVE-2020-8426 | 2020-01-29 | Advisory |
| High 7.2 | <= 2.8.3 | 2.8.4 | CVE-2020-7109 | 2020-01-19 | Advisory |
| High 8.8 | < 2.7.5 | 2.7.5 | CVE-2020-7055 | 2019-10-28 | Advisory |
| High 8.8 | <= 1.7.12 | 1.8.0 | CVE-2017-18596 | 2017-11-27 | Advisory |
Check if a site is affected
Enter a site address to see which version of Elementor Website Builder – more than just a page builder and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Elementor Website Builder – more than just a page builder plugin safe to use?
All 61 known issues are fixed in current versions (4.3.6 or later). Keeping it updated is what matters.
How do I check which version of Elementor Website Builder – more than just a page builder my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome