UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2020-15020

Elementor Website Builder – more than just a page builder: Cross-site Scripting

Severity
Medium 5.4
Published
7 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.9.14
Also known as
WPV-6515725f13fd
Sources
NVD, WPVulnerability

Description

An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.

Affected software

SoftwareAffected versions
ElementorServers and applications · cpe:a:elementor:website_builder
  • Every version up to 2.9.13
ElementorWordPress plugins · wp-plugin:elementor
  • Every version before 2.9.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15020
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15020
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-website-builder-2913-authenticated-stored-cross-site-scripting