Elementor Website Builder
Monthly
Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no credentials of their own induce a logged-in WordPress administrator into silently executing unintended state-changing actions inside the victim's authenticated session. Exploitation requires both a privileged user to be authenticated and that user to be lured onto attacker-controlled content (CVSS UI:R), which caps practical severity despite the high base score of 8.8 reported by the researcher; our independent assessment scores the same vector at C:L/I:L/A:N because the achievable action set is not fully characterised in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score or client-side patch detail was supplied in the source data.
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenticated users to access protected information due to missing authorization checks (CWE-862). The vulnerability stems from insufficient capability verification before exposing sensitive data to lower-privileged roles, enabling a contributor to retrieve data they should not have access to. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk on any site with untrusted contributor accounts.
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPress users to exceed their intended authorization boundaries by exploiting incorrectly configured access control security levels. The missing authorization checks (CWE-862) allow a scoped integrity modification - no confidentiality or availability impact is indicated. With a CVSS score of 2.7 (Low), EPSS at 0.02% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this vulnerability presents low urgency in practice despite the widespread deployment footprint of the plugin.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowing authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. An attacker can exploit this via a crafted page or element to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), but carries a moderate CVSS score of 6.5 with cross-site impact (S:C), indicating meaningful business risk despite not being unauthenticated.
Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no credentials of their own induce a logged-in WordPress administrator into silently executing unintended state-changing actions inside the victim's authenticated session. Exploitation requires both a privileged user to be authenticated and that user to be lured onto attacker-controlled content (CVSS UI:R), which caps practical severity despite the high base score of 8.8 reported by the researcher; our independent assessment scores the same vector at C:L/I:L/A:N because the achievable action set is not fully characterised in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score or client-side patch detail was supplied in the source data.
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenticated users to access protected information due to missing authorization checks (CWE-862). The vulnerability stems from insufficient capability verification before exposing sensitive data to lower-privileged roles, enabling a contributor to retrieve data they should not have access to. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk on any site with untrusted contributor accounts.
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPress users to exceed their intended authorization boundaries by exploiting incorrectly configured access control security levels. The missing authorization checks (CWE-862) allow a scoped integrity modification - no confidentiality or availability impact is indicated. With a CVSS score of 2.7 (Low), EPSS at 0.02% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this vulnerability presents low urgency in practice despite the widespread deployment footprint of the plugin.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowing authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. An attacker can exploit this via a crafted page or element to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), but carries a moderate CVSS score of 6.5 with cross-site impact (S:C), indicating meaningful business risk despite not being unauthenticated.