Elementor Page Builder
Vendor:
First CVE: Sep 10, 2019 · Active for 6 years
8
Total CVEs
More Total CVEs than 85% of tracked products
2.7
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 42% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Elementor Page Builder over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 10, 2019
6 years ago
Most Recent CVE
Jun 10, 2025
409 days ago
CVE Severity & Scoring
Elementor Page Builder8 CVEs
63%
13%
25%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (37.5%)
Unknown0 (0.0%)
Required5 (62.5%)
Privileges Required
Low7 (87.5%)
High0 (0.0%)
None1 (12.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-7055CRITICAL An issue was discovered in Elementor 2.7.4. Arbitrary file upload is possible in the Elementor Import Templates function, allowing an attacker to execute code via a crafted ZIP arc | Apr 22, 2020 | 9.9 | 31 | NO | NO |
CVE-2020-13126CRITICAL An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscr | May 17, 2020 | 9.9 | 28 | NO | NO |
CVE-2017-18596HIGH The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. | Sep 10, 2019 | 8.8 | 28 | NO | NO |
CVE-2020-13864MEDIUM The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted | Jun 5, 2020 | 5.4 | 21 | NO | NO |
CVE-2020-20406MEDIUM A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering o | Sep 16, 2020 | 5.4 | 20 | NO | NO |
CVE-2018-18379MEDIUM The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. | Oct 7, 2019 | 6.1 | 20 | NO | NO |
CVE-2025-3076MEDIUM The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due | Jun 10, 2025 | 5.4 | 18 | NO | NO |
CVE-2020-13865MEDIUM The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabili | Jun 5, 2020 | 5.4 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Elementor Page Builder
Top CWEs
Versions
No cataloged versions.