elemntor has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 5.4 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Products
- Elementor Website Builder – more than just a page builder 1
- Hello Plus 1
- Image Optimizer – Compress Images and Convert to WebP or AVIF 1
Worst active — by depth score
CVE-2026-5821High· 8.1Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection45CVE-2026-5727Medium· 5.4The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.730CVE-2026-11905Medium· 4.3The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter24
elemntor vulnerabilities
CVEs affecting elemntor, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-11905Medium· 4.3The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possibl…
CVE-2026-5727Medium· 5.4The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7
The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl…
CVE-2026-5821High· 8.1Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in…