{
    "title": "Elementor vulnerabilities: exploits and patches since 2020",
    "seo_title": "Elementor security flaws: exploits, patches, safe versions",
    "h1": "Elementor vulnerabilities: exploits and patches since 2020",
    "description": "Elementor vulnerabilities since 2020: 51 published by WPScan, the most severe ones explained, and the three exploited Elementor Pro vulnerabilities.",
    "lead": "Elementor has 51 vulnerabilities published since 2020, mostly contributor XSS, but also file uploads leading to code execution. The documented attacks targeted Elementor Pro, up to August 2026.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/",
    "canonical": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/",
    "markdown": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/index.md",
    "json": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/index.json",
    "published": "2026-10-20T07:00:00+00:00",
    "modified": "2026-10-29T12:04:25+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Elementor vulnerabilities: exploits and patches since 2020",
            "url": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/",
            "markdown": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/index.md",
            "json": "https://www.wp-masquerade.com/elementor-security-vulnerabilities/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Failles de sécurité Elementor : exploits et correctifs depuis 2020",
            "url": "https://www.wp-masquerade.com/fr/failles-securite-elementor/",
            "markdown": "https://www.wp-masquerade.com/fr/failles-securite-elementor/index.md",
            "json": "https://www.wp-masquerade.com/fr/failles-securite-elementor/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Vulnerabilidades de Elementor: exploits y parches desde 2020",
            "url": "https://www.wp-masquerade.com/es/vulnerabilidades-elementor/",
            "markdown": "https://www.wp-masquerade.com/es/vulnerabilidades-elementor/index.md",
            "json": "https://www.wp-masquerade.com/es/vulnerabilidades-elementor/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Elementor-Sicherheitslücken: Exploits und Patches seit 2020",
            "url": "https://www.wp-masquerade.com/de/elementor-sicherheitsluecken/",
            "markdown": "https://www.wp-masquerade.com/de/elementor-sicherheitsluecken/index.md",
            "json": "https://www.wp-masquerade.com/de/elementor-sicherheitsluecken/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Vulnerabilità di Elementor: exploit e patch dal 2020",
            "url": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-elementor/",
            "markdown": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-elementor/index.md",
            "json": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-elementor/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Vulnerabilidades do Elementor: exploits e correções desde 2020",
            "url": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-elementor/",
            "markdown": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-elementor/index.md",
            "json": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-elementor/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Kwetsbaarheden in Elementor: exploits en patches sinds 2020",
            "url": "https://www.wp-masquerade.com/nl/elementor-kwetsbaarheden-beveiliging/",
            "markdown": "https://www.wp-masquerade.com/nl/elementor-kwetsbaarheden-beveiliging/index.md",
            "json": "https://www.wp-masquerade.com/nl/elementor-kwetsbaarheden-beveiliging/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Elementor vulnerabilities: exploits and patches since 2020"
        },
        {
            "level": 2,
            "text": "Elementor in brief"
        },
        {
            "level": 2,
            "text": "Timeline of Elementor vulnerabilities from 2020 to October 2026"
        },
        {
            "level": 2,
            "text": "The notable vulnerabilities explained"
        },
        {
            "level": 3,
            "text": "Template imports, an open door twice"
        },
        {
            "level": 3,
            "text": "March 2021: the editor XSS"
        },
        {
            "level": 3,
            "text": "April 2022: the onboarding module in versions 3.6.0 to 3.6.2"
        },
        {
            "level": 3,
            "text": "2024: file deletion by a contributor"
        },
        {
            "level": 3,
            "text": "September 2026: two versions and a forged request"
        },
        {
            "level": 2,
            "text": "Elementor Pro: three exploited vulnerabilities"
        },
        {
            "level": 2,
            "text": "What this history shows"
        },
        {
            "level": 2,
            "text": "Protecting your site"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "Elementor runs on more than 10 million WordPress sites, and WPScan attributes 51 vulnerabilities published between January 2020 and mid-October 2026 to it. Most are medium-severity vulnerabilities that require an account, but a few allowed code execution on the server. Here are the ones that matter, what to remember about the others, and the three Elementor Pro vulnerabilities actually exploited by attackers.\n\n## Elementor in brief\n\nElementor is a visual page builder published by Elementor Ltd. The free plugin, released on wordpress.org in May 2016 under the slug `elementor`, has more than 10 million active installations (wordpress.org); version 4.3.5 was released on October 13, 2026. Elementor Pro, sold on the vendor's website, adds forms, the theme builder and WooCommerce widgets, among other things. The two plugins are separate: a Pro vulnerability does not affect a site that only uses the free version, and vice versa.\n\nThis popularity makes it an obvious target: a single exploitable vulnerability affects millions of sites, and bots know how to spot Elementor in page code. A whole ecosystem of add-on plugins has grown around it; we have already traced the history of [Ultimate Addons for Elementor](https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/) and covered the critical vulnerability in Essential Addons for Elementor (CVE-2023-32243).\n\n## Timeline of Elementor vulnerabilities from 2020 to October 2026\n\n![Timeline: January 14, 2020, PHP file hidden in an imported template, fixed in 2.7.5; May 6, 2020, Elementor Pro, file upload by a subscriber, exploited, fixed in Pro 2.9.4; March 2021, six stored XSS fixed in 3.1.4; April 13, 2022, file upload by a subscriber via the onboarding module, versions 3.6.0 to 3.6.2, fixed in 3.6.3; March 22, 2023, Elementor Pro, settings changeable by a WooCommerce customer, exploited, fixed in 3.11.7; May 2, 2023, administrator-only SQL injection, fixed in 3.12.2; December 6, 2023, code execution via template import, fixed in 3.18.2; February 7, 2024, file deletion, fixed in 3.19.1; August 19, 2026, Elementor Pro, unauthenticated file upload, exploited, fixed in 4.2.2; September 25, 2026, forged request against an administrator, versions 4.3.0 and 4.3.1, fixed in 4.3.2.](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-elementor-en.webp)\n\n*Elementor's major vulnerabilities; the three events labeled \"Elementor Pro\" concern the paid plugin.*\n\nFor the free plugin, the following table only includes critical or high vulnerabilities, those that require no account and those that were widely discussed. The date is the WPScan publication date; the [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) is the one from the authority that assigned the [CVE](https://www.wp-masquerade.com/glossary/cve/) (CNA), supplemented by NVD when the two differ significantly. None of these free-version vulnerabilities is documented as exploited by a recognized source.\n\n| Published | Fixed in | Type | CVSS | CVE | Account required |\n| --- | --- | --- | --- | --- | --- |\n| January 14, 2020 | 2.7.5 | PHP file upload via template import (ZIP archive) | 9.9 (NVD) | CVE-2020-7055 | Contributor |\n| March 31, 2020 | 2.9.6 | Safe mode can be enabled, security plugins disabled | 6.5 (NVD) | CVE-2020-20634 | Any logged-in account |\n| March 17, 2021 | 3.1.4 | Six stored XSS (Heading, Accordion, Image Box, Icon Box, Divider, Column widgets) | 5.4 (NVD) | CVE-2021-24201 to CVE-2021-24206 | Contributor |\n| April 13, 2022 | 3.6.3 (affected: 3.6.0 to 3.6.2) | File upload and code execution (onboarding module) | 8.8 | CVE-2022-1329 | Subscriber |\n| June 13, 2022 | 3.5.6 | DOM-based XSS | 4.7 (Patchstack), 6.1 (NVD) | CVE-2022-29455 | None (the victim clicks a link) |\n| May 2, 2023 | 3.12.2 | SQL injection (Replace URL tool) | 7.2 | CVE-2023-0329 | Administrator |\n| November 8, 2023 | 3.16.5 | Missing access control, attachment reading | 6.5 (Patchstack), 9.8 (NVD) | CVE-2023-47504 | Logged-in account |\n| December 6, 2023 | 3.18.2 (affected: 3.3.0 to 3.18.1) | File upload and code execution (template import) | 9.9 (Patchstack), 8.8 (Wordfence) | CVE-2023-48777 | Contributor |\n| February 7, 2024 | 3.19.1 | File deletion and PHAR deserialization | 8.5 (Patchstack) | CVE-2024-24934 | Contributor |\n| September 25, 2026 | 4.3.2 (affected: 4.3.0 to 4.3.1) | Cross-site request forgery (CSRF), privilege escalation | 8.8 (Patchstack) | CVE-2026-62062 | None (an administrator must click) |\n\n*Free Elementor: 10 notable vulnerabilities out of the 51 published by WPScan from January 1, 2020 to October 17, 2026.*\n\nThe 41 other vulnerabilities, almost all of medium severity, can be summarized year by year:\n\n- **2020**: four [XSS](https://www.wp-masquerade.com/glossary/xss/) requiring an account (custom links, template name, system info page) and the SVG image filtering bypass fixed in 2.9.8. An XSS during template creation, fixed in 2.8.4, is rated 9.8 by NVD but 4.8 by WPScan, which requires elevated privileges.\n- **2021**: besides the six XSS in the table, SVG image uploads allowed by default (fixed in 3.0.14) and a DOM-based XSS fixed in 3.4.8.\n- **2023**: a missing authorization check fixed in 3.13.2, an iframe injection and an XSS related to inline SVGs.\n- **2024**: six contributor XSS (widget attributes, typography settings, Text Path widget), arbitrary SVG file downloads and the exposure of private content titles.\n- **2025**: six contributor XSS, two of them in the Text Path widget, an administrator-only file read (3.30.3) and a missing authorization check (3.33.1).\n- **2026 up to October 17**: three contributor XSS, two of them via the REST API, two missing authorization checks, and four vulnerabilities that let a contributor read templates or private and draft content; the last one, published on October 14 and fixed in 4.2.4, even exposed the plaintext password of protected posts.\n\n## The notable vulnerabilities explained\n\n### Template imports, an open door twice\n\nElementor lets you import a template as a ZIP archive. Researchers Sam Thomas and Kyle Fleming showed that an archive containing folders could drop a PHP file on the server, and therefore run commands on it, from a mere contributor account (CVE-2020-7055). Version 2.7.5 fixed the problem as early as October 28, 2019, before the vulnerability was published in January 2020.\n\nThe same mechanism resurfaced in December 2023 (CVE-2023-48777). The import function saved the file in a temporary folder before checking its type and did not delete it when it was rejected. On December 6, 2023, Wordfence spotted a partial fix in 3.18.1, judged it insufficient and alerted Elementor the same day; version 3.18.2 completed the fix on December 8. Versions 3.3.0 to 3.18.1 were affected.\n\n### March 2021: the editor XSS\n\nIn February 2021, Wordfence reported a series of stored XSS in widgets to Elementor, for a plugin the vendor then said was on more than 7 million sites. The editor offered, for example, a fixed list of HTML tags for a heading or a column, but the server accepted any value sent in the save request: a contributor could put JavaScript there, executed for everyone who viewed, edited or previewed the page. A first fix arrived in 3.1.2 on March 2, 2021, completed in 3.1.4. This pattern explains the long series of contributor XSS in the following years; our article on XSS vulnerabilities in WordPress details the mechanism.\n\n### April 2022: the onboarding module in versions 3.6.0 to 3.6.2\n\nVersion 3.6.0, released on March 22, 2022, introduced an onboarding module loaded on every admin request, including those from a subscriber. Its AJAX actions did not check the user's permissions: any logged-in account could change site data and upload an archive containing PHP code, hence remote code execution (CVE-2022-1329, discovered by Ramuel Gall of Wordfence). The vulnerability existed for only three weeks: version 3.6.3 of April 12, 2022 fixed it. It mainly targeted sites that allow registration, such as WooCommerce stores.\n\n### 2024: file deletion by a contributor\n\nCVE-2024-24934, rated 8.5 by Patchstack, combined a directory traversal and a deserialization of PHAR files: a contributor could delete files from the server and, under certain conditions, go further. Version 3.19.1 of February 5, 2024 fixed it, two days before it was published.\n\n### September 2026: two versions and a forged request\n\nThe most recent high-severity vulnerability only affects versions 4.3.0 (September 22, 2026) and 4.3.1 (September 23). The `is_own_route_request` function let some REST API requests through without checking the security token (nonce). An unauthenticated attacker could therefore prepare a link or a page that, when opened by a logged-in administrator, made their browser perform any REST action allowed for their role: create an administrator account, change settings, delete content (CVE-2026-62062, reported by Saggre through the Wordfence PRISM program according to WPScan). Version 4.3.2 came out on September 24, and the vulnerability was published the next day.\n\n## Elementor Pro: three exploited vulnerabilities\n\nThe vulnerabilities actually exploited concern the paid plugin, which is not counted in the 51 vulnerabilities above.\n\n| Published | Fixed in | Type | CVSS | CVE | Account required | Exploitation |\n| --- | --- | --- | --- | --- | --- | --- |\n| May 6, 2020 | 2.9.4 | File upload and code execution | 9.9 | CVE-2020-13126 | Subscriber | Yes, from May 6, 2020 |\n| March 28, 2023 | 3.11.7 | Changing site settings (WooCommerce module) | 8.8 | CVE-2023-3124 | Any logged-in account | Yes, reported by Patchstack in late March 2023 |\n| August 19, 2026 | 4.2.2 | File upload via a form and code execution | 9.0 (Patchstack), 9.8 (Wordfence) | CVE-2026-32475 | None | Yes, from August 19, 2026 |\n\n*Elementor Pro: the vulnerabilities whose exploitation is documented by Wordfence or Patchstack.*\n\n**May 2020.** Attackers combined a vulnerability in Ultimate Addons for Elementor (premium version), which created a subscriber account even with registration closed, and an Elementor Pro vulnerability that let this subscriber upload an executable file. Elementor released 2.9.4 on May 7, 2020. The episode is detailed in [our Ultimate Addons for Elementor timeline](https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/).\n\n**March 2023.** In the Elementor Pro WooCommerce module, an AJAX action called the WordPress `update_option` function with user-supplied values, without checking permissions. Any logged-in customer of a store could open registration, set the default role to administrator, then create an administrator account. Jérôme Bruandet (NinTechNet) reported it on March 18, 2023, and version 3.11.7 fixed it on March 22. Patchstack then observed attacks that dropped files such as `wp-rate.php` and changed the site address. Only sites with WooCommerce active were exposed.\n\n**August 2026.** CVE-2026-32475 is the most severe of the three, because it requires no account. On a published page with a Form widget containing a non-required file upload field (the default setting), an attacker first sent an empty file, then a PHP file: validation stopped at the first item, and processing saved the second one in `/wp-content/uploads/elementor/forms/`. Tin Pham reported it to Patchstack on July 16, 2026; version 4.2.2 and the Patchstack advisory came out on August 19. According to Wordfence, attacks began the same day, and its firewall had blocked nearly 200,000 of them by early September. Any PHP file in this folder is a sign of compromise.\n\n*The spring 2023 attacks on Elementor Pro 3.11.6 and what to check, by WPDev (in English).*\n\n![Bar chart of free Elementor vulnerabilities published per year according to WPScan: 8 in 2020 including 2 critical, 8 in 2021 all medium, 2 in 2022 including 1 high, 6 in 2023 including 1 critical and 1 high, 9 in 2024 including 1 high, 8 in 2025 all medium, 10 in 2026 up to October 17 including 1 high and 1 low; 51 in total.](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-elementor-en-1.webp)\n\n*WPScan database, January 1, 2020 to October 17, 2026; severity according to the CNA, otherwise NVD.*\n\n## What this history shows\n\n- **The contributor, the main entry point**: the vast majority of the free plugin's vulnerabilities require a contributor account, because the Elementor editor is open to that role. The risk therefore depends on who can log in.\n- **File uploads, the most dangerous vulnerability**: template import in 2020 and 2023, onboarding module in 2022, Pro forms in 2020 and 2026.\n- **Fast fixes**: for the major vulnerabilities, the fixed version almost always came out before or on the day of publication. In 2026, however, the attack on Pro started on the day of the fix: the gap between publication and updating has become the critical moment.\n- **Pro and free are not the same**: the three documented exploitations targeted Elementor Pro. Check both plugins separately.\n\nWordPress core is not spared regular fixes either, as [our timeline of WordPress security releases](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) shows.\n\n## Protecting your site\n\n- **Update** Elementor (at least 4.3.2, ideally the latest version) and Elementor Pro (at least 4.2.2). Pro updates through the Elementor license: check that it is properly connected.\n- **Turn on automatic updates**, at least for patch releases: the 2026 case shows that a few hours count. Our guide to automatic plugin updates explains how to do it safely.\n- **Limit accounts**: close registration if you do not need it, grant the Contributor role sparingly and delete inactive accounts (see roles and least privilege).\n- **Check your forms**: a file upload field is only useful if it is really needed. Prevent PHP execution in `/wp-content/uploads/` at the server level.\n- **Remove unnecessary plugins**, including Elementor add-ons you no longer use (see abandoned plugins).\n- **Add a web application firewall** to cover the gap between a publication and your update (our comparison of WordPress firewalls), and **watch the announcements** that concern your plugins (our method).\n\nWP Masquerade Pro helps you not miss an announcement. Every day, it compares the installed versions with the public WPVulnerability.net database and sends a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/) with the severity and the fixed version; the member area shows [pending updates and vulnerable sites](https://www.wp-masquerade.com/features/#surveillance), and the [integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/) spots modified core files. WP Masquerade alerts you: it does not fix Elementor and is not a firewall, so updating remains essential. For a firewall, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/).\n\nRead also: [The best WordPress page builders compared: Gutenberg, Elementor, Divi, Bricks and more](https://www.wp-masquerade.com/best-wordpress-page-builders-compared/).\n\n### Key takeaways\n\n- WPScan lists 51 vulnerabilities in free Elementor from January 1, 2020 to October 17, 2026, 7 of them critical or high (CNA score, otherwise NVD).\n- Most require a contributor account; the most severe concern file uploads (2020, 2022, 2023).\n- The documented exploitations target Elementor Pro: May 2020, March 2023 and August 2026 (CVE-2026-32475, no account needed).\n- Minimum versions: Elementor 4.3.2 and Elementor Pro 4.2.2; look for any PHP file in `/wp-content/uploads/elementor/forms/`.\n\n## Sources\n\n- WordPress.org: Elementor Website Builder, plugin page and active installations (https://wordpress.org/plugins/elementor/)\n- NVD: CVE-2022-1329 (April 19, 2022) (https://nvd.nist.gov/vuln/detail/CVE-2022-1329)\n- NVD: CVE-2024-24934 (May 17, 2024) (https://nvd.nist.gov/vuln/detail/CVE-2024-24934)\n\nOther sources consulted: further CVE records, trade press articles, Wordfence, WPScan and Patchstack databases.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "Vulnerable plugins"
    ],
    "format": "application/json"
}