Threat database

33 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	8.8	EPSS 0.1%	CVE-2026-62062Elementor Website Builder · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.1%2026-09-25CVE Database V5CVE-2026-62062 Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1. EPSS 0.1%Vulnerability Elementor #cwe-352	CVE Database V5	2026-09-25
High	7.1	EPSS 0.1%	CVE-2026-84759Activity Log · Cross-Site Request Forgery (CSRF) High7.1EPSS 0.1%2026-09-02CVE Database V5CVE-2026-84759 Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions. EPSS 0.1%Vulnerability Elementor #cwe-352	CVE Database V5	2026-09-02
Critical	9.0	EPSS 2.0%	CVE-2026-32475Elementor Pro · Unrestricted Upload of File with Dangerous Type Critical9.0EPSS 2.0%2026-08-19CVE Database V5CVE-2026-32475 Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1. EPSS 2.0%Vulnerability Elementor #cwe-434	CVE Database V5	2026-08-19
Medium	6.5	EPSS 0.4%	CVE-2026-57619Elementor Website Builder · Missing Authorization Medium6.5EPSS 0.4%2026-06-25CVE Database V5CVE-2026-57619 Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. EPSS 0.4%Vulnerability Elementor #cwe-862	CVE Database V5	2026-06-25
Medium	5.4	EPSS 0.3%	CVE-2026-49782Elementor Website Builder · Missing Authorization Medium5.4EPSS 0.3%2026-06-02CVE Database V5CVE-2026-49782 Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0. EPSS 0.3%Vulnerability Elementor #cwe-862	CVE Database V5	2026-06-02
Low	2.7	EPSS 0.3%	CVE-2026-32445Elementor Website Builder · Missing Authorization Low2.7EPSS 0.3%2026-03-13CVE Database V5CVE-2026-32445 Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5. EPSS 0.3%Vulnerability Elementor	CVE Database V5	2026-03-13
Medium	6.5	EPSS 0.2%	CVE-2026-32352Elementor Website Builder · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elementor… Medium6.5EPSS 0.2%2026-03-13CVE Database V5CVE-2026-32352 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-Based XSS.This issue affects Elementor Website Builder: from n/a through <= 3.35.5. EPSS 0.2%Vulnerability Elementor	CVE Database V5	2026-03-13
Medium	6.5	EPSS 0.2%	CVE-2024-50555Elementor Website Builder · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elementor… Medium6.5EPSS 0.2%2026-02-20CVE Database V5CVE-2024-50555 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0. EPSS 0.2%Vulnerability Elementor	CVE Database V5	2026-02-20
Medium	4.3	EPSS 0.4%	CVE-2026-25387Image Optimizer by Elementor · Missing Authorization Medium4.3EPSS 0.4%2026-02-19CVE Database V5CVE-2026-25387 Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1. EPSS 0.4%Vulnerability Elementor	CVE Database V5	2026-02-19
Medium	5.3	EPSS 0.2%	CVE-2026-25386Ally · Missing Authorization Medium5.3EPSS 0.2%2026-02-19CVE Database V5CVE-2026-25386 Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2. EPSS 0.2%Vulnerability Elementor	CVE Database V5	2026-02-19
Medium	4.3	EPSS 0.2%	CVE-2025-67588Elementor Website Builder · Missing Authorization Medium4.3EPSS 0.2%2025-12-09CVE Database V5CVE-2025-67588 Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0. EPSS 0.2%Vulnerability Elementor	CVE Database V5	2025-12-09
Medium	6.4	EPSS 0.2%	CVE-2025-3076Elementor Website Builder Pro · Cross-site Scripting Medium6.4EPSS 0.2%2025-06-10CVE Database V5CVE-2025-3076 The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.2%Vulnerability https://elementor.com/#cwe-79	CVE Database V5	2025-06-10
Medium	5.9	EPSS 0.4%	CVE-2025-32640Ally · Cross-site Scripting Medium5.9EPSS 0.4%2025-04-09CVE Database V5CVE-2025-32640 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This issue affects Ally: from n/a through <= 3.1.0. EPSS 0.4%Vulnerability Elementor	CVE Database V5	2025-04-09
Medium	6.5	EPSS 0.3%	CVE-2024-54444Elementor Website Builder · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elementor… Medium6.5EPSS 0.3%2025-02-25CVE Database V5CVE-2024-54444 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10. EPSS 0.3%Vulnerability Elementor	CVE Database V5	2025-02-25
Medium	4.3	EPSS 0.3%	CVE-2024-8494Elementor Website Builder Pro · Exposure of Sensitive Information to an Unauthorized Actor Medium4.3EPSS 0.3%2025-01-30CVE Database V5CVE-2024-8494 The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of Private, Pending, and Draft Templates. The vulnerability was partially patched in version 3.24.4. EPSS 0.3%Vulnerability https://elementor.com/#cwe-200	CVE Database V5	2025-01-30
High	7.1	EPSS 0.3%	CVE-2024-35656Elementor Pro · Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') High7.1EPSS 0.3%2024-07-22CVE Database V5CVE-2024-35656 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This issue affects Elementor Pro: from n/a through 3.21.2. EPSS 0.3%Vulnerability Elementor #cwe-79	CVE Database V5	2024-07-22
Medium	5.5	EPSS 0.3%	CVE-2024-37437Elementor Website Builder · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elementor… Medium5.5EPSS 0.3%2024-07-09CVE Database V5CVE-2024-37437 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue affects Elementor Website Builder: from n/a through <= 3.22.1. EPSS 0.3%Vulnerability Elementor	CVE Database V5	2024-07-09
High	8.5	EPSS 0.7%	CVE-2024-24934Elementor Website Builder · Path Traversal High8.5EPSS 0.7%2024-05-17CVE Database V5CVE-2024-24934 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0. EPSS 0.7%Vulnerability Elementor #cwe-22	CVE Database V5	2024-05-17
Medium	6.4	EPSS 0.4%	CVE-2024-4107Elementor Website Builder Pro · Cross-site Scripting Medium6.4EPSS 0.4%2024-05-09CVE Database V5CVE-2024-4107 The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.4%Vulnerability https://elementor.com/#cwe-79	CVE Database V5	2024-05-09

Showing 1–20 of 33 results · 1 duplicate CVE record merged