SecAlerts
e

elementor

Security Risk Profile

46
/100
medium

Security Risk Score

Comprehensive risk assessment based on 104 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from September 10, 2019 to present

104
Total CVEs
18
Critical+High
4
Exploited
14
Unpatched

Threat Assessment

Avg CVSS
6.3
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
14
Critical/High
Risk Level
46/100
medium
⚠️ 4 Active Exploits🆕 1Fresh (<7d)📈 6 in Last 30 Days

Severity Distribution

Critical
7
High
11
Medium
82
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
16

Age Distribution

Common Weaknesses (CWE)

1
XSS
66
2
Infoleak
6
3
Malicious File Upload
5
4
Path Traversal
3
5
Code Injection
1

Most Affected Products

1. Elementor Website Builder WordPress38
2. Elementor Elementor Website Builder13
3. Elementor Website Builder13
4. Elementor Elementor Page Builder Wordpress8
5. Elementor Elementor Pro Wordpress7

Recent Vulnerabilities

See more →
CVE-2026-120850
CVSS 6.5medium

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Nov 7, 2026🔧 No Patch
CVE-2026-109883
CVSS 7.1high

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Nov 6, 2026🔧 No Patch
CVE-2026-109884
CVSS 7.1high

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Nov 6, 2026🔧 No Patch
CVE-2026-81812
CVSS 6.4medium

Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload

Oct 21, 2026🔧 No Patch
CVE-2026-81813
CVSS 6.8medium

Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass

Oct 21, 2026🔧 No Patch
CVE-2026-11905
CVSS 4.3medium

Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters

Oct 15, 2026🔧 No Patch
CVE-2026-90953
CVSS 4.3medium

Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks

Sep 30, 2026🔧 No Patch
CVE-2026-62062
CVSS 8.8high

WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Sep 25, 2026🔧 No Patch
CVE-2026-77150
CVSS 6.1medium

Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting

Sep 11, 2026🔧 No Patch
https://reddit.com/r/cybersecurity/comments/1w9q1cx/elementor_pro_wordpress_plugin_vulnerability/
unknown

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Sep 7, 2026🔧 No Patch

Monitor elementor in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

elementor Security Vulnerabilities & Risk Score | 104 CVEs | SecAlerts - SecAlerts