297 matches found
CVE-2026-81812
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered fi...
CVE-2026-81813
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes i...
CVE-2026-81813 Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes i...
CVE-2026-81812 Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered fi...
WordPress Elementor Website Builder plugin < 4.3.5 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by NGUYỄN ĐỨC HÒA in WordPress Plugin Elementor Website Builder versions 4.3.5...
WordPress Elementor Website Builder plugin < 4.3.5 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Elementor Website Builder versions 4.3.5...
EUVD-2026-107083
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes i...
EUVD-2026-107082
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered fi...
CVE-2026-81812
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered fi...
CVE-2026-81813
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes i...
PT-2026-120478
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered fi...
PT-2026-120479
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes i...
CVE-2022-1329
CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...
CVE-2026-62062
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-62062 CVE-2026-62062 Elementor Website Builder 4.3.1 - Elementor I am @abraxasnull. Loopback lab. The client is CVE-2026-62062-Abraxas-Labs.py. CSRF via a substring. Elementor 4.3.0-4.3.1 skips WordPress REST...
CVE-2026-11905
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keysconversionmap' parameter. This makes it possible for authenticated attackers, with contributor-level access a...
CVE-2026-11905
The Elementor Website Builder for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 4.2.3 . The root cause is a Missing Authorization flaw involving the 'keys_conversion_map' and 'is_public' parameters. This allows authenticated attackers with contribut...
CVE-2026-11905 Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keysconversionmap' parameter. This makes it possible for authenticated attackers, with contributor-level access a...
EUVD-2026-101863
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keysconversionmap' parameter. This makes it possible for authenticated attackers, with contributor-level access a...
WordPress Elementor Website Builder – more than just a page builder plugin <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Or Benit in WordPress Plugin Elementor Website Builder versions = 4.2.3...
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery CSRF vulnerability, which has yet to ...