CVE-2024-2117

Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Path Widget in all versions up to, and including, 3.20.2 due to insufficient output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 408,602 live websites that are affected by CVE-2024-2117.

Run a Free Instant Scan



Affected Software

Product  Elementor
Category Landing Page Builders
Vulnerable Domains408,602 live websites (16% of Elementor install base)
Vulnerable Versions
  • from 0 through 3.20.2
Vulnerable Versions Count221 versions ( 61% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Apr 9, 2024
  • Updated - Apr 8, 2026

Credits

  • Craig Smith (finder)

Website Distribution by Country

Number of websites using CVE-2024-2117
United States76,377 websites


Germany41,990 websites
France25,607 websites
Italy21,443 websites
Russia16,927 websites
GB16,345 websites
Spain15,400 websites
Poland15,310 websites
Brazil14,796 websites
Netherlands11,303 websites

Website Distribution by TLD

Number of websites using CVE-2024-2117
.com148,235 websites
.de23,807 websites
.it15,227 websites
.ru13,531 websites
.com.br13,474 websites
.org13,079 websites
.pl11,627 websites
.fr10,589 websites
.nl9,788 websites
.co.uk8,465 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-2117

Top websites that are affected by CVE-2024-2117. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com United States*,***
**********.com United States*,***
**.***.br Brazil*,***
*****.com United States*,***
*****.com United States*,***
*********.com United States*,***
**********.com United States*,***
****.bg Bulgaria*,***
********.com GB*,***
***************.org United States*,***
See full domain list

FAQ

CVE-2024-2117 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Elementor
A total of 408,602 websites have been identified as vulnerable to CVE-2024-2117, based on global website indexing conducted by WebTechSurvey.
The Elementor is affected by the CVE-2024-2117 vulnerability.
Elementor versions up to and including 3.20.2 are vulnerable to CVE-2024-2117.