Extension WordPress
Vulnérabilités Elementor Website Builder Pro
Cette page rassemble les failles publiées pour Elementor Website Builder Pro, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Elementor Website Builder Pro
16 fiches
Elementor Website Builder <= 3.29.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…
*-3.29.0
3.29.1
19/06/2025
Elementor Pro <= 3.29.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible…
*-3.29.0
3.29.1
09/06/2025
Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 – Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above,…
*-3.25.10
3.25.11
29/01/2025
Elementor Pro <= 3.21.2 – Reflected Cross-Site Scripting
The Elementor Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.21.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-3.21.2
3.21.3
28/06/2024
Elementor Website Builder Pro <= 3.21.0 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and…
*-3.21.0
3.21.2
02/05/2024
Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user…
*-3.20.1
3.20.2
26/03/2024
Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output…
*-3.20.1
3.20.2
26/03/2024
Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user…
*-3.20.1
3.20.2
26/03/2024
Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible…
*-3.20.1
3.20.2
26/03/2024
Elementor Website Builder Pro <= 3.20.1 – Authententicated (Contributor+) Stored Cross-Site Scripting
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This…
*-3.20.1
3.20.2
26/03/2024
Elementor Pro <= 3.19.2 – Authenticated (Contributor+) Information Exposure
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.19.2 . This makes it possible for authenticated attackers, with contributor-level access and above, to extract arbitrary…
*-3.19.2
3.19.3
26/02/2024
Elementor Pro <= 3.13.0 – Missing Authorization
The Elementor Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.13.0. This makes…
*-3.13.0
3.13.1
20/06/2023
Elementor Pro <= 3.11.6 – Authenticated(Subscriber+) Privilege Escalation via update_page_option
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level…
*-3.11.6
3.11.7
28/03/2023
Elementor Pro <= 3.0.5 – Authenticated Remote Code Execution in Dynamic OOO Widget
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet.…
*-3.0.5
3.0.6
06/10/2020
Elementor Pro <= 2.9.3 – Authenticated (Subscriber+) Arbitrary File Upload
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve…
[*, 2.9.4)
2.9.4
06/05/2020
Elementor Pro <= 2.0.9 – Cross-Site Scripting
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
[*, 2.0.10)
2.0.10
26/10/2018
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.