PatchWatch Logo PATCHWATCH
Resources Vulnerabilities Elementor Website Builder Stored XSS
Patched & Mitigated

Elementor Website Builder Stored Cross-Site Scripting (XSS)

CVE-2024-2123 CVSS 8.8 (High) Disclosed: June 2, 2026
Affected Versions <= 3.20.0
Fixed Version v3.20.1
Vulnerability Type Stored XSS

Vulnerability Overview

A vulnerability was identified in Elementor Website Builder, a WordPress plugin active on over 5 million installations. Due to insufficient sanitization and escaping of input fields inside custom block layout structures, users with author or contributor roles could insert malicious JavaScript payloads into active template blocks.

Because these layout blocks are stored in the WordPress database and loaded dynamically across frontend templates, the injected code runs automatically whenever an admin or visitor views the affected pages.

Security Impact & Exploit Vector

An attacker leveraging Stored XSS on a high-traffic WordPress site can execute a wide variety of malicious tasks:

  • Administrative Hijack: Injected scripts can execute code in the context of an administrator viewing the page. The script can silently create new admin accounts, edit theme files, or insert backdoor redirects.
  • Session Stealing: Session tokens and auth cookies can be harvested and transmitted to hacker-controlled servers, bypassing standard login forms.
  • Malicious Redirects: Visitors can be transparently redirected to spam portals, advertising pop-ups, or phishing interfaces.
Is my site affected? If your WordPress dashboard lists Elementor Version 3.20.0, 3.19.x, or earlier, your layout structure contains this flaw. Immediate action is required to seal the backend.

How to Remediate This Vulnerability

Method 1: Manual Update (Recommended)

Log in to your WordPress dashboard, navigate to Plugins > Installed Plugins, and locate the Elementor extension. Click Update Now to install version 3.20.1 or higher. This replaces the insecure handler classes with safe, sanitized parsing libraries.

Method 2: Proactive Virtual Patching with PatchWatch

If you cannot update Elementor immediately due to theme incompatibilities or custom code dependencies, you can protect your site using the PatchWatch Virtual Patching Engine.

Our diagnostic plugin intercepts incoming HTTP payload streams, scanning for character injections matching the XSS signature. If an exploit query is detected, PatchWatch blocks the query at the request level, allowing your legacy Elementor version to run safely without code modifications.


Frequently Asked Questions

Is Elementor safe to keep on my site?

Yes. Elementor is maintained by a professional security and engineering team. However, because it contains massive custom code structures, exploits will occasionally be disclosed. Keep automatic updates enabled to remain safe.

Does the free version have this vulnerability?

Yes, both the Free and Pro editions of Elementor below version 3.20.1 contained the affected widget attributes.

Shield Your WordPress Site

Stop leaving your business site vulnerable. PatchWatch runs silent integrity scans and applies virtual patches instantly.

Real-time CVE comparison
Automated file hash monitoring
Instant virtual security patches
Deploy Free Plugin

Metadata Registry

Plugin Namespace: elementor
Total Downloads: 5,000,000+
CVSS Metric: 8.8 Stored XSS
CVE Identifier: CVE-2024-2123
Security Severity: High Risk