Elementor

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions8
First seenAug 20, 2026
Last mentionedSep 26, 2026

Timeline

8 articles · newest first

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.

The Hacker NewsSep 26, 09:55 UTC · Sep 26, 2026Vulnerability1 · 1 read

Elementor WordPress flaw lets attackers create admin accounts

Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.

BleepingComputerSep 25, 18:13 UTC · Sep 25, 2026Vulnerability2 · 1 read

Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites

Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.

PatchstackSep 25, 09:31 UTC · Sep 25, 2026Vulnerability1 · 1 read

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.

SecurityWeekSep 5, 13:00 UTC · Sep 5, 2026Exploit / PoCExploitedCVE-2026-324753

Elementor Pro RCE Flaw Under Active Attack

A critical Elementor Pro Forms module flaw allowing unauthenticated file uploads is under active attack against widely used WordPress sites.

SOCRadarSep 4, 13:34 UTC · Sep 4, 2026Exploit / PoCExploited2

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

The Hacker NewsSep 4, 08:48 UTC · Sep 4, 2026Exploit / PoCExploitedCVE-2026-14894 CVE-2026-324752

Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin

Attackers actively exploit a critical unauthenticated file upload flaw in Elementor Pro (6M+ installs), enabling remote code execution and site takeover.

WordfenceSep 2, 15:07 UTC · Sep 2, 2026Exploit / PoCExploited1 · 1 read

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.

The Hacker NewsAug 20, 06:04 UTC · Aug 20, 2026VulnerabilityCVE-2026-32475 CVE-2026-656407 · 2 reads

Related CVEs

by mentions

CVE-2026-324752%9.0
Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
published Aug 19, 2026Elementor Pro (WordPress plugin)
CVE-2026-148943%9.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the…
published Jul 10, 2026WordPressPoC
CVE-2026-656402%8.8
Author-Level RCE in WordPress Core via Malicious Postscript File Upload
published Aug 17, 2026WordPress (core)

Appears with

WordPressproduct · 8
Elementor Proproduct · 5
Patchstackorganization · 4
Elementororganization · 3
Elementorproduct · 3
Automatticvendor · 2
Patchstackvendor · 2
Wordfencevendor · 2
WordPressvendor · 1
Defiantorganization · 1
Wordfenceorganization · 1
Super Formsproduct · 1
Defiantvendor · 1
Mushr00w_upl.phpmalware · 1

Entities are extracted by the model from each article. First seen Aug 20, 2026, last mentioned Sep 26, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.