💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Elementor Website Builder Pro

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > Elementor Website Builder Pro

Information

Software Type	Plugin
Software Slug	elementor-pro
Software Status	Active
Software Author	https://elementor.com/
Software Website	elementor.com
Software Record Last Updated	May 2, 2024

13 Vulnerabilities

Submit a Vulnerability

Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting

6.1

CVE-2024-35656

Jun 28, 2024

Researcher: Michael

Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4

CVE-2024-4107

May 2, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-1364

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag

6.4

CVE-2024-2781

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVE-2024-2121

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation

5.4

CVE-2024-2120

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload

6.4

CVE-2024-1521

Mar 26, 2024

Researcher: wesley (wcraft)

Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure

4.3

CVE-2024-23523

Feb 26, 2024

Researcher: Dynamic.ooo Team

Elementor Pro <= 3.13.0 - Missing Authorization

6.3

CVE-2023-35050

Jun 20, 2023

Researcher: Rafie Muhammad

Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option

8.8

CVE-2023-3124

Mar 28, 2023

Researcher: Jerome Bruandet

Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget

7.2

CVE-2020-26596

Oct 6, 2020

Researchers:

Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload

9.9

CVE-2020-13126

May 6, 2020

Researcher: Chloe Chamberland

Elementor Pro <= 2.0.9 - Cross-Site Scripting

6.1

CVE-2018-18379

Oct 26, 2018

Researcher: Christopher Vella

Title	Status	CVE ID	CVSS	Researchers	Date
Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting	Patched	CVE-2024-35656	6.1	Michael	June 28, 2024
Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Patched	CVE-2024-4107	6.4	wesley (wcraft)	May 2, 2024
Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-1364	6.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag	Patched	CVE-2024-2781	6.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-2121	5.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation	Patched	CVE-2024-2120	5.4	wesley (wcraft)	March 26, 2024
Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload	Patched	CVE-2024-1521	6.4	wesley (wcraft)	March 26, 2024
Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure	Patched	CVE-2024-23523	4.3	Dynamic.ooo Team	February 26, 2024
Elementor Pro <= 3.13.0 - Missing Authorization	Patched	CVE-2023-35050	6.3	Rafie Muhammad	June 20, 2023
Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option	Patched	CVE-2023-3124	8.8	Jerome Bruandet	March 28, 2023
Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget	Patched	CVE-2020-26596	7.2		October 6, 2020
Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload	Patched	CVE-2020-13126	9.9	Chloe Chamberland	May 6, 2020
Elementor Pro <= 2.0.9 - Cross-Site Scripting	Patched	CVE-2018-18379	6.1	Christopher Vella	October 26, 2018

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.