SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Elementor — verificado contra la base de datos de seguridad local de WP Clinic.
elementordrag-and-dropeditorelementorlanding pagepage builder
51 CVEs conocidos registrados para Elementor.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-8825 | Elementor Website Builder – more than just a page builder [elementor] < 4.1.4 | Exposición de información sensible a un actor no autorizado | Desconocido | < 4.1.4 | 4.1.4 | 2026-07-20 | ✓ corregido en la última versión |
| CVE-2026-57619 | Elementor Website Builder – more than just a page builder [elementor] < 4.1.4 | Falta de control de autorización | Media 6,5 | < 4.1.4 | 4.1.4 | 2026-06-25 | ✓ corregido en la última versión |
| CVE-2026-49782 | Elementor Website Builder – more than just a page builder [elementor] < 4.1.1 | Falta de control de autorización | Media 5,4 | < 4.1.1 | 4.1.1 | 2026-06-02 | ✓ corregido en la última versión |
| CVE-2026-6127 | Elementor Website Builder – more than just a page builder [elementor] < 4.0.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 4.0.5 | 4.0.5 | 2026-04-30 | ✓ corregido en la última versión |
| CVE-2025-14732 | Elementor Website Builder – more than just a page builder [elementor] < 3.35.6 | Neutralización incorrecta de sintaxis alternativa de XSS | Media 6,4 | < 3.35.6 | 3.35.6 | 2026-04-07 | ✓ corregido en la última versión |
| CVE-2026-32445 | Elementor Website Builder – more than just a page builder [elementor] < 3.35.6 | Falta de control de autorización | Baja 2,7 | < 3.35.6 | 3.35.6 | 2026-03-07 | ✓ corregido en la última versión |
| CVE-2026-32352 | Elementor Website Builder – more than just a page builder [elementor] < 3.35.6 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,5 | < 3.35.6 | 3.35.6 | 2026-02-13 | ✓ corregido en la última versión |
| CVE-2025-11220 | Elementor Website Builder – more than just a page builder [elementor] < 3.33.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 3.33.4 | 3.33.4 | 2025-12-15 | ✓ corregido en la última versión |
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive user or configuration data.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _elementor_data meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the _elementor_data meta field with show_in_rest but omits a sanitize_callback, relying instead on a rest_pre_insert_post filter (sanitize_post_data function) that only sanitizes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the json_decode() call on the raw body returns null, causing all sanitization to be skipped. The unsanitized data is then stored via update_post_meta() and later output without escaping through multiple widget sinks including the HTML widget's print_unescaped_setting() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.35.5. This makes it possible for authenticated attackers, with author-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Text Path widget in all versions up to, and including, 3.33.3 due to insufficient neutralization of user-supplied input used to build SVG markup inside the widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2025-67588 | Elementor Website Builder – more than just a page builder [elementor] < 3.33.1 | Falta de control de autorización | Media 4,3 | < 3.33.1 | 3.33.1 | 2025-11-25 | ✓ corregido en la última versión |
| CVE-2024-50555 | Elementor Website Builder – more than just a page builder [elementor] < 3.29.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,5 | < 3.29.1 | 3.29.1 | 2025-06-19 | ✓ corregido en la última versión |
| CVE-2024-54444 | Elementor Website Builder – more than just a page builder [elementor] < 3.25.11 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,5 | < 3.25.11 | 3.25.11 | 2025-02-24 | ✓ corregido en la última versión |
| CVE-2024-13445 | Elementor Website Builder – more than just a page builder [elementor] < 3.27.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 3.27.5 | 3.27.5 | 2025-02-19 | ✓ corregido en la última versión |
| CVE-2024-10453 | Elementor Website Builder – more than just a page builder [elementor] < 3.25.10 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 3.25.10 | 3.25.10 | 2024-12-20 | ✓ corregido en la última versión |
| CVE-2024-8236 | Elementor Website Builder – more than just a page builder [elementor] < 3.25.8 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.25.8 | 3.25.8 | 2024-11-25 | ✓ corregido en la última versión |
| CVE-2024-6757 | Elementor Website Builder – more than just a page builder [elementor] < 3.24.6 | Exposición de información sensible a un actor no autorizado | Media 4,3 | < 3.24.6 | 3.24.6 | 2024-10-14 | ✓ corregido en la última versión |
| CVE-2024-5416 | Elementor Website Builder – more than just a page builder [elementor] < 3.24.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.24.0 | 3.24.0 | 2024-09-10 | ✓ corregido en la última versión |
| CVE-2024-37437 | Elementor Website Builder – more than just a page builder [elementor] < 3.22.2 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 5,5 | < 3.22.2 | 3.22.2 | 2024-06-28 | ✓ corregido en la última versión |
| CVE-2024-4619 | Elementor Website Builder – more than just a page builder [elementor] < 3.22.0-beta2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.22.0-beta2 | 3.22.0-beta2 | 2024-05-20 | ✓ corregido en la última versión |
| CVE-2024-2117 | Elementor Website Builder – more than just a page builder [elementor] < 3.20.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.20.3 | 3.20.3 | 2024-03-26 | ✓ corregido en la última versión |
| CVE-2024-0506 | Elementor Website Builder – more than just a page builder [elementor] < 3.19.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.19.0 | 3.19.0 | 2024-02-07 | ✓ corregido en la última versión |
| CVE-2024-24934 | Elementor Website Builder – more than just a page builder [elementor] < 3.19.1 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Alta 8,5 | < 3.19.1 | 3.19.1 | 2024-02-07 | ✓ corregido en la última versión |
| CVE-2023-48777 | Elementor Website Builder – more than just a page builder [elementor] < 3.18.2 | Carga de archivos sin restricción de tipo peligroso | Crítica 9,9 | < 3.18.2 | 3.18.2 | 2023-12-06 | ✓ corregido en la última versión |
| CVE-2023-47505 | Elementor Website Builder – more than just a page builder [elementor] < 3.16.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,5 | < 3.16.5 | 3.16.5 | 2023-11-08 | ✓ corregido en la última versión |
| CVE-2023-47504 | Elementor Website Builder – more than just a page builder [elementor] < 3.16.5 | Autenticación indebida | Media 6,5 | < 3.16.5 | 3.16.5 | 2023-11-08 | ✓ corregido en la última versión |
| CVE-2022-4953 | Elementor Website Builder – more than just a page builder [elementor] < 3.5.5 | Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) | Media 6,1 | < 3.5.5 | 3.5.5 | 2023-07-19 | ✓ corregido en la última versión |
| CVE-2020-36703 | Elementor Website Builder – more than just a page builder [elementor] < 2.9.8 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.9.8 | 2.9.8 | 2023-06-07 | ✓ corregido en la última versión |
| CVE-2023-0329 | Elementor Website Builder – more than just a page builder [elementor] < 3.12.2 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,2 | < 3.12.2 | 3.12.2 | 2023-05-30 | ✓ corregido en la última versión |
| CVE-2023-33922 | Elementor Website Builder – more than just a page builder [elementor] < 3.13.3 | Falta de control de autorización | Media 4,3 | < 3.13.3 | 3.13.3 | 2023-05-22 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 3.13.2 | — | Desconocido | < 3.13.2 | 3.13.2 | 2023-05-12 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 3.13.2 | — | Desconocido | < 3.13.2 | 3.13.2 | 2023-05-12 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 3.12.2 | — | Desconocido | < 3.12.2 | 3.12.2 | 2023-04-24 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 3.12.2 | — | Desconocido | < 3.12.2 | 3.12.2 | 2023-04-24 | ✓ corregido en la última versión |
| CVE-2022-29455 | Elementor Website Builder – more than just a page builder [elementor] < 3.5.6 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,7 | < 3.5.6 | 3.5.6 | 2022-06-13 | ✓ corregido en la última versión |
| CVE-2022-1329 | Elementor Website Builder – more than just a page builder [elementor] >= 3.6.0 - <= 3.6.2 | Carga de archivos sin restricción de tipo peligroso | Alta 8,8 | 3.6.0–3.6.2 | 3.6.2 | 2022-04-13 | ✓ corregido en la última versión |
| CVE-2021-24891 | Elementor Website Builder – more than just a page builder [elementor] < 3.6.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 3.6.3 | 3.6.3 | 2021-03-23 | ✓ corregido en la última versión |
| CVE-2021-24202 | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| CVE-2021-24203 | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| CVE-2021-24204 | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| CVE-2021-24205 | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| CVE-2021-24206 | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| CVE-2021-24201 | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 | — | Desconocido | < 3.1.4 | 3.1.4 | 2021-03-17 | ✓ corregido en la última versión |
| CVE-2020-36171 | Elementor Website Builder – more than just a page builder [elementor] < 3.0.14 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 3.0.14 | 3.0.14 | 2020-11-25 | ✓ corregido en la última versión |
| CVE-2020-15020 | Elementor Website Builder – more than just a page builder [elementor] < 2.9.14 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.9.14 | 2.9.14 | 2020-07-07 | ✓ corregido en la última versión |
| CVE-2020-13864 | Elementor Website Builder – more than just a page builder [elementor] < 2.9.9 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.9.9 | 2.9.9 | 2020-06-05 | ✓ corregido en la última versión |
| CVE-2020-13865 | Elementor Website Builder – more than just a page builder [elementor] < 2.9.10 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.9.10 | 2.9.10 | 2020-06-05 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 2.9.8 | — | Desconocido | < 2.9.8 | 2.9.8 | 2020-04-21 | ✓ corregido en la última versión |
| CVE-2020-20634 | Elementor Website Builder – more than just a page builder [elementor] < 2.9.6 | — | Media 6,5 | < 2.9.6 | 2.9.6 | 2020-03-31 | ✓ corregido en la última versión |
| CVE-2020-20406 | Elementor Website Builder – more than just a page builder [elementor] < 2.9.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.9.3 | 2.9.3 | 2020-02-26 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 2.7.6 | — | Desconocido | < 2.7.6 | 2.7.6 | 2020-01-29 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 2.7.6 | — | Desconocido | < 2.7.6 | 2.7.6 | 2020-01-29 | ✓ corregido en la última versión |
| CVE-2020-8426 | Elementor Website Builder – more than just a page builder [elementor] < 2.8.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.8.5 | 2.8.5 | 2020-01-28 | ✓ corregido en la última versión |
| CVE-2020-7109 | Elementor Website Builder – more than just a page builder [elementor] < 2.8.4 | — | Crítica 9,8 | < 2.8.4 | 2.8.4 | 2020-01-19 | ✓ corregido en la última versión |
| CVE-2020-7055 | Elementor Website Builder – more than just a page builder [elementor] < 2.7.5 | Carga de archivos sin restricción de tipo peligroso | Crítica 9,9 | < 2.7.5 | 2.7.5 | 2019-10-28 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 1.8.0 | — | Desconocido | < 1.8.0 | 1.8.0 | 2017-12-02 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 1.8.8 | — | Desconocido | < 1.8.8 | 1.8.8 | 2017-12-02 | ✓ corregido en la última versión |
| CVE-2017-18596 | Elementor Website Builder – more than just a page builder [elementor] < 1.8.0 | Gestión incorrecta de privilegios | Alta 8,8 | < 1.8.0 | 1.8.0 | 2017-11-27 | ✓ corregido en la última versión |
| CVE-2025-4566 | Elementor Website Builder – more than just a page builder [elementor] < 3.30.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 3.30.3 | 3.30.3 | 0000-00-00 | ✓ corregido en la última versión |
| CVE-2025-3075 | Elementor Website Builder – more than just a page builder [elementor] < 3.29.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.29.1 | 3.29.1 | 0000-00-00 | ✓ corregido en la última versión |
| CVE-2025-8081 | Elementor Website Builder – more than just a page builder [elementor] < 3.30.3 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 4,9 | < 3.30.3 | 3.30.3 | 0000-00-00 | ✓ corregido en la última versión |
| CVE-2026-1206 | Elementor Website Builder – more than just a page builder [elementor] < 3.35.8 | — | Desconocido | < 3.35.8 | 3.35.8 | 0000-00-00 | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 2.9.8 | — | Desconocido | < 2.9.8 | 2.9.8 | — | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 2.7.7 | — | Desconocido | < 2.7.7 | 2.7.7 | — | ✓ corregido en la última versión |
| — | Elementor Website Builder – more than just a page builder [elementor] < 3.13.2 | — | Desconocido | < 3.13.2 | 3.13.2 | — | ✓ corregido en la última versión |
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.33.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.25.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap parameters in all versions up to, and including, 3.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Settings in all versions up to, and including, 3.25.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the get_image_alt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract either excerpt data or titles of private or password-protected posts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in Elementor Editor pages. This was partially patched in version 3.23.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to arbitrary SVG file download in all versions up to, and including, 3.22.1. This is due to the plugin not properly restricting access to files. This makes it possible for authenticated attackers, with contributor-level access and above, to download arbitrary SVG files.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘hover_animation’ parameter in versions up to, and including, 3.21.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.20.3). Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Elementor Website Builder Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.20.3. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.19.0). wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Elementor Website Builder Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.19.0. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.19.1). Rhynorater (Justin Gardner) discovered and reported this Arbitrary File Deletion vulnerability in WordPress Elementor Website Builder Plugin. This could allow a malicious actor to delete files from your website. If core files are deleted from your website, it could cause your site to break and stop functioning. This vulnerability has been fixed in version 3.19.1. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.18.2). Hồng Quân (luk6785 at VNPT-VCI) discovered and reported this Arbitrary File Upload vulnerability in WordPress Elementor Website Builder Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 3.18.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.16.5). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Elementor Website Builder Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.16.5.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.16.5). Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress Elementor Website Builder Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.16.5.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘settings’ hash parameter in versions up to, and including, 3.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary iframes in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor plugin for WordPress is vulnerable to the creation of emergent resources due to insufficient input validation in the template "save_item" function in versions up to, and including, 3.13.3. This allows authenticated attackers, with contributor-level permissions or above, to create templates with an arbitrary post type, potentially allowing the exploitation of other plugins that depend on custom post types.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the register_as_beta_tester(), ajax_enable_safe_mode(), ajax_get_category_items(), and ajax_re_migrate_globals() functions called via AJAX actions in versions up to, and including, 3.13.1. This makes it possible for authenticated attackers with minimal permissions such as subscribers to perform many actions such as registering the site for beta testing, enabling safe mode, remigrating globals and retrieving category items.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Update the WordPress Elementor Website Builder plugin to the latest available version (at least 3.13.2). An unknown person discovered and reported this Broken Access Control vulnerability in WordPress Elementor Website Builder Plugin. This vulnerability has been fixed in version 3.13.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elementor plugin for WordPress is vulnerable to blind SQL Injection via the 'replace_urls' functionality in versions up to, and including, 3.12.1 due to insufficient escaping on the user supplied 'old' and 'new' parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Update the Elementor plugin to the latest available version (at least 3.12.2). An unknown person discovered and reported this SQL Injection vulnerability in WordPress Elementor Website Builder Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 3.12.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elementor Website Builder plugin for WordPress is vulnerable to Unauthenticated DOM-based Reflected Cross-Site Scripting via the ‘videoType’ and 'onError' parameter in the lightbox module in versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder plugin for WordPress is vulnerable to DOM-based Cross-Site Scripting via the '#elementor-action:action=lightbox&settings=' DOM in versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities found by WordFence in WordPress Elementor Website Builder plugin (versions <= 3.1.1).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized malicious SVG file uploads in versions up to, and including, 3.0.13. This is due to improper restrictions on allowing SVG file uploads. This makes it possible for authenticated attackers with post editor access to upload SVG files that could contain malicious content such as web scripts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Elementor Website Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor WordPress plugin could allow an authenticated user to enable Safe Mode. This could allow the user to then disable plugins, which could include security plugins, which would weaken the overall security of the site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by Marc Alexandre Montpas (Sucuri) in WordPress Elementor Page Builder plugin (versions <= 2.7.5).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elementor Website Builder for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.5 that makes it possible for attackers to inject arbitrary web scripts via the elementor_js_log AJAX action. This requires low-level authenticated user access to exploit.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Elementor Page Builder before 2.8.4 does not sanitise data when creating a new template, which could lead to Cross-Site Scripting issues
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
The Elementor Website Builder plugin for WordPress is vulnerable to arbitrary file upload by subscriber level users and above due to missing authorization on the Import Templates function, which makes it possible for attackers to gain remote code execution. This affects versions up to 2.7.5.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Authenticated Unrestricted Editing vulnerability found by James Golovich in WordPress Elementor Page Builder (version <=1.7.12).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Potential Privilege Escalation vulnerability found in WordPress Elementor Page Builder (versions <=1.8.7).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elementor Website Builder plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 1.7.12. This is due to many AJAX actions being accessible to all logged-in users due to a lack of capability checks on the associated functions. This makes it possible for authenticated attackers to gain otherwise restricted access to backend functions and perform actions like editing posts and importing/exporting content.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This attack affects only Chrome/Edge browsers
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Jerome Bruandet, from NinTechNet, discovered a bypass in the SVG sanitizer, which could lead to an authenticated stored XSS issue from users with the upload_files capability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
According to the original researcher, "A successful attack results in malicious scripts being injected on the plugin’s System Info page"
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
The plugin does not check user capabilities on several functions, allowing authenticated attackers with a low amount of privilege (such as Subscribers) to perform actions that should only be available to users with higher privileges.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Mantén Elementor actualizado — 4.1.5 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.