Sploitus

15 exploited vulnerabilities in Elementor Website Builder

Vulnerabilities with publicly known exploits

Vendors
Elementor, WordPress
With known exploits
15
Affected Elementor Website Builder versions
< 3.18.2, 3.6.2, 3.12.2, 3.21.1, 2.9.7, 3.5.5, 3.1.4, 3.4.8

Vulnerabilities with exploits

Highest CVSS first — 11 of these already have exploit code on Sploitus

CVE-2023-48777 3 exploits
CVSS 9.9 CRITICAL 2023-12-08FIX AVAILABLE
📄 WordPress Elementor 3.18.1 Shell UploadElementor < 3.18.2 - Contributor+ Arbitrary File Upload to RCE via Template Import
CVE-2022-1329 9 exploits
CVSS 8.8 HIGH 2022-04-17FIX AVAILABLE
Exploit for Missing Authorization in Elementor Website_BuilderExploit for Unrestricted Upload of File with Dangerous Type in Elementor Website_Builder
CVE-2023-0329 6 exploits
CVSS 7.2 HIGH 2023-05-30FIX AVAILABLE
📄 Elementor Website Builder SQL InjectionElementor Website Builder < 3.12.2 - Admin+ SQLi
CVE-2024-4107
CVSS 6.4 MEDIUM 2024-05-09FIX AVAILABLE
CVE-2020-36703
CVSS 6.4 MEDIUM 2023-06-07FIX AVAILABLE
CVE-2022-29455 6 exploits
CVSS 6.4 MEDIUM 2022-06-13FIX AVAILABLE
Exploit for Cross-site Scripting in Elementor Website_BuilderExploit for Cross-site Scripting in Elementor Website_Builder
CVE-2022-4953 4 exploits
CVSS 6.1 MEDIUM 2023-08-14FIX AVAILABLE
Wordpress Elementor 3.5.5 Plugin - Iframe Injection VulnerabilityWordpress Plugin Elementor 3.5.5 - Iframe Injection
CVE-2021-24891
CVSS 6.1 MEDIUM 2021-11-23FIX AVAILABLE
CVE-2021-24206 1 exploit
CVSS 5.4 MEDIUM 2021-04-05FIX AVAILABLE
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
CVE-2021-24205 1 exploit
CVSS 5.4 MEDIUM 2021-04-05FIX AVAILABLE
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
CVE-2021-24204 1 exploit
CVSS 5.4 MEDIUM 2021-04-05FIX AVAILABLE
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
CVE-2021-24203 1 exploit
CVSS 5.4 MEDIUM 2021-04-05FIX AVAILABLE
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget
CVE-2021-24202 1 exploit
CVSS 5.4 MEDIUM 2021-04-05FIX AVAILABLE
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
CVE-2021-24201 1 exploit
CVSS 5.4 MEDIUM 2021-04-05FIX AVAILABLE
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
CVE-2026-8825
CVSS 4.9 MEDIUM 2026-07-20FIX AVAILABLE