Elementor runs on more than 10 million WordPress sites, and WPScan attributes 51 vulnerabilities published between January 2020 and mid-October 2026 to it. Most are medium-severity vulnerabilities that require an account, but a few allowed code execution on the server. Here are the ones that matter, what to remember about the others, and the three Elementor Pro vulnerabilities actually exploited by attackers.
Elementor in brief
Elementor is a visual page builder published by Elementor Ltd. The free plugin, released on wordpress.org in May 2016 under the slug elementor, has more than 10 million active installations (wordpress.org); version 4.3.5 was released on October 13, 2026. Elementor Pro, sold on the vendor's website, adds forms, the theme builder and WooCommerce widgets, among other things. The two plugins are separate: a Pro vulnerability does not affect a site that only uses the free version, and vice versa.
This popularity makes it an obvious target: a single exploitable vulnerability affects millions of sites, and bots know how to spot Elementor in page code. A whole ecosystem of add-on plugins has grown around it; we have already traced the history of Ultimate Addons for Elementor and covered the critical vulnerability in Essential Addons for Elementor (CVE-2023-32243).
Timeline of Elementor vulnerabilities from 2020 to October 2026
For the free plugin, the following table only includes critical or high vulnerabilities, those that require no account and those that were widely discussed. The date is the WPScan publication date; the CVSS score is the one from the authority that assigned the CVE (CNA), supplemented by NVD when the two differ significantly. None of these free-version vulnerabilities is documented as exploited by a recognized source.
| Published | Fixed in | Type | CVSS | CVE | Account required |
|---|---|---|---|---|---|
| January 14, 2020 | 2.7.5 | PHP file upload via template import (ZIP archive) | 9.9 (NVD) | CVE-2020-7055 | Contributor |
| March 31, 2020 | 2.9.6 | Safe mode can be enabled, security plugins disabled | 6.5 (NVD) | CVE-2020-20634 | Any logged-in account |
| March 17, 2021 | 3.1.4 | Six stored XSS (Heading, Accordion, Image Box, Icon Box, Divider, Column widgets) | 5.4 (NVD) | CVE-2021-24201 to CVE-2021-24206 | Contributor |
| April 13, 2022 | 3.6.3 (affected: 3.6.0 to 3.6.2) | File upload and code execution (onboarding module) | 8.8 | CVE-2022-1329 | Subscriber |
| June 13, 2022 | 3.5.6 | DOM-based XSS | 4.7 (Patchstack), 6.1 (NVD) | CVE-2022-29455 | None (the victim clicks a link) |
| May 2, 2023 | 3.12.2 | SQL injection (Replace URL tool) | 7.2 | CVE-2023-0329 | Administrator |
| November 8, 2023 | 3.16.5 | Missing access control, attachment reading | 6.5 (Patchstack), 9.8 (NVD) | CVE-2023-47504 | Logged-in account |
| December 6, 2023 | 3.18.2 (affected: 3.3.0 to 3.18.1) | File upload and code execution (template import) | 9.9 (Patchstack), 8.8 (Wordfence) | CVE-2023-48777 | Contributor |
| February 7, 2024 | 3.19.1 | File deletion and PHAR deserialization | 8.5 (Patchstack) | CVE-2024-24934 | Contributor |
| September 25, 2026 | 4.3.2 (affected: 4.3.0 to 4.3.1) | Cross-site request forgery (CSRF), privilege escalation | 8.8 (Patchstack) | CVE-2026-62062 | None (an administrator must click) |
The 41 other vulnerabilities, almost all of medium severity, can be summarized year by year:
- 2020: four XSS requiring an account (custom links, template name, system info page) and the SVG image filtering bypass fixed in 2.9.8. An XSS during template creation, fixed in 2.8.4, is rated 9.8 by NVD but 4.8 by WPScan, which requires elevated privileges.
- 2021: besides the six XSS in the table, SVG image uploads allowed by default (fixed in 3.0.14) and a DOM-based XSS fixed in 3.4.8.
- 2023: a missing authorization check fixed in 3.13.2, an iframe injection and an XSS related to inline SVGs.
- 2024: six contributor XSS (widget attributes, typography settings, Text Path widget), arbitrary SVG file downloads and the exposure of private content titles.
- 2025: six contributor XSS, two of them in the Text Path widget, an administrator-only file read (3.30.3) and a missing authorization check (3.33.1).
- 2026 up to October 17: three contributor XSS, two of them via the REST API, two missing authorization checks, and four vulnerabilities that let a contributor read templates or private and draft content; the last one, published on October 14 and fixed in 4.2.4, even exposed the plaintext password of protected posts.
The notable vulnerabilities explained
Template imports, an open door twice
Elementor lets you import a template as a ZIP archive. Researchers Sam Thomas and Kyle Fleming showed that an archive containing folders could drop a PHP file on the server, and therefore run commands on it, from a mere contributor account (CVE-2020-7055). Version 2.7.5 fixed the problem as early as October 28, 2019, before the vulnerability was published in January 2020.
The same mechanism resurfaced in December 2023 (CVE-2023-48777). The import function saved the file in a temporary folder before checking its type and did not delete it when it was rejected. On December 6, 2023, Wordfence spotted a partial fix in 3.18.1, judged it insufficient and alerted Elementor the same day; version 3.18.2 completed the fix on December 8. Versions 3.3.0 to 3.18.1 were affected.
March 2021: the editor XSS
In February 2021, Wordfence reported a series of stored XSS in widgets to Elementor, for a plugin the vendor then said was on more than 7 million sites. The editor offered, for example, a fixed list of HTML tags for a heading or a column, but the server accepted any value sent in the save request: a contributor could put JavaScript there, executed for everyone who viewed, edited or previewed the page. A first fix arrived in 3.1.2 on March 2, 2021, completed in 3.1.4. This pattern explains the long series of contributor XSS in the following years; our article on XSS vulnerabilities in WordPress details the mechanism.
April 2022: the onboarding module in versions 3.6.0 to 3.6.2
Version 3.6.0, released on March 22, 2022, introduced an onboarding module loaded on every admin request, including those from a subscriber. Its AJAX actions did not check the user's permissions: any logged-in account could change site data and upload an archive containing PHP code, hence remote code execution (CVE-2022-1329, discovered by Ramuel Gall of Wordfence). The vulnerability existed for only three weeks: version 3.6.3 of April 12, 2022 fixed it. It mainly targeted sites that allow registration, such as WooCommerce stores.
2024: file deletion by a contributor
CVE-2024-24934, rated 8.5 by Patchstack, combined a directory traversal and a deserialization of PHAR files: a contributor could delete files from the server and, under certain conditions, go further. Version 3.19.1 of February 5, 2024 fixed it, two days before it was published.
September 2026: two versions and a forged request
The most recent high-severity vulnerability only affects versions 4.3.0 (September 22, 2026) and 4.3.1 (September 23). The is_own_route_request function let some REST API requests through without checking the security token (nonce). An unauthenticated attacker could therefore prepare a link or a page that, when opened by a logged-in administrator, made their browser perform any REST action allowed for their role: create an administrator account, change settings, delete content (CVE-2026-62062, reported by Saggre through the Wordfence PRISM program according to WPScan). Version 4.3.2 came out on September 24, and the vulnerability was published the next day.
Elementor Pro: three exploited vulnerabilities
The vulnerabilities actually exploited concern the paid plugin, which is not counted in the 51 vulnerabilities above.
| Published | Fixed in | Type | CVSS | CVE | Account required | Exploitation |
|---|---|---|---|---|---|---|
| May 6, 2020 | 2.9.4 | File upload and code execution | 9.9 | CVE-2020-13126 | Subscriber | Yes, from May 6, 2020 |
| March 28, 2023 | 3.11.7 | Changing site settings (WooCommerce module) | 8.8 | CVE-2023-3124 | Any logged-in account | Yes, reported by Patchstack in late March 2023 |
| August 19, 2026 | 4.2.2 | File upload via a form and code execution | 9.0 (Patchstack), 9.8 (Wordfence) | CVE-2026-32475 | None | Yes, from August 19, 2026 |
May 2020. Attackers combined a vulnerability in Ultimate Addons for Elementor (premium version), which created a subscriber account even with registration closed, and an Elementor Pro vulnerability that let this subscriber upload an executable file. Elementor released 2.9.4 on May 7, 2020. The episode is detailed in our Ultimate Addons for Elementor timeline.
March 2023. In the Elementor Pro WooCommerce module, an AJAX action called the WordPress update_option function with user-supplied values, without checking permissions. Any logged-in customer of a store could open registration, set the default role to administrator, then create an administrator account. Jérôme Bruandet (NinTechNet) reported it on March 18, 2023, and version 3.11.7 fixed it on March 22. Patchstack then observed attacks that dropped files such as wp-rate.php and changed the site address. Only sites with WooCommerce active were exposed.
August 2026. CVE-2026-32475 is the most severe of the three, because it requires no account. On a published page with a Form widget containing a non-required file upload field (the default setting), an attacker first sent an empty file, then a PHP file: validation stopped at the first item, and processing saved the second one in /wp-content/uploads/elementor/forms/. Tin Pham reported it to Patchstack on July 16, 2026; version 4.2.2 and the Patchstack advisory came out on August 19. According to Wordfence, attacks began the same day, and its firewall had blocked nearly 200,000 of them by early September. Any PHP file in this folder is a sign of compromise.
What this history shows
- The contributor, the main entry point: the vast majority of the free plugin's vulnerabilities require a contributor account, because the Elementor editor is open to that role. The risk therefore depends on who can log in.
- File uploads, the most dangerous vulnerability: template import in 2020 and 2023, onboarding module in 2022, Pro forms in 2020 and 2026.
- Fast fixes: for the major vulnerabilities, the fixed version almost always came out before or on the day of publication. In 2026, however, the attack on Pro started on the day of the fix: the gap between publication and updating has become the critical moment.
- Pro and free are not the same: the three documented exploitations targeted Elementor Pro. Check both plugins separately.
WordPress core is not spared regular fixes either, as our timeline of WordPress security releases shows.
Protecting your site
- Update Elementor (at least 4.3.2, ideally the latest version) and Elementor Pro (at least 4.2.2). Pro updates through the Elementor license: check that it is properly connected.
- Turn on automatic updates, at least for patch releases: the 2026 case shows that a few hours count. Our guide to automatic plugin updates explains how to do it safely.
- Limit accounts: close registration if you do not need it, grant the Contributor role sparingly and delete inactive accounts (see roles and least privilege).
- Check your forms: a file upload field is only useful if it is really needed. Prevent PHP execution in
/wp-content/uploads/at the server level. - Remove unnecessary plugins, including Elementor add-ons you no longer use (see abandoned plugins).
- Add a web application firewall to cover the gap between a publication and your update (our comparison of WordPress firewalls), and watch the announcements that concern your plugins (our method).
WP Masquerade Pro helps you not miss an announcement. Every day, it compares the installed versions with the public WPVulnerability.net database and sends a vulnerability alert by email with the severity and the fixed version; the member area shows pending updates and vulnerable sites, and the integrity check spots modified core files. WP Masquerade alerts you: it does not fix Elementor and is not a firewall, so updating remains essential. For a firewall, see our comparison of the best WordPress security plugins.
Read also: The best WordPress page builders compared: Gutenberg, Elementor, Divi, Bricks and more.
Key takeaways
- WPScan lists 51 vulnerabilities in free Elementor from January 1, 2020 to October 17, 2026, 7 of them critical or high (CNA score, otherwise NVD).
- Most require a contributor account; the most severe concern file uploads (2020, 2022, 2023).
- The documented exploitations target Elementor Pro: May 2020, March 2023 and August 2026 (CVE-2026-32475, no account needed).
- Minimum versions: Elementor 4.3.2 and Elementor Pro 4.2.2; look for any PHP file in
/wp-content/uploads/elementor/forms/.
Sources
- WordPress.org: Elementor Website Builder, plugin page and active installations (external link, opens in a new tab)
- NVD: CVE-2022-1329 (April 19, 2022) (external link, opens in a new tab)
- NVD: CVE-2024-24934 (May 17, 2024) (external link, opens in a new tab)
Other sources consulted: further CVE records, trade press articles, Wordfence, WPScan and Patchstack databases.
