Elementor bug bounty programs
elementor.com Updated
Elementor runs two public programs: a Sorona bug bounty paying up to $31,200 and a Bugcrowd bug bounty paying up to $5,000.
- Top reward
- $31,200
- Sorona
- Programs
- 2
- 2 pay cash
- Targets in scope
- 15
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Elementor
Sorona · Pays the most of the 2 programs: up to $31,200.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Elementor
Sorona · Bug bounty |
– | – | – | – | $31,200 | Partial | – | – | Open |
|
Elementor: Bug Bounty Program
Bugcrowd · Bug bounty |
$4,000 (highest) | $2,000 (highest) | $500 (highest) | – | $5,000 | Full | – | – | Open |
-
- Safe harbor
- Partial
-
- Critical
- $4,000 (highest)
- High
- $2,000 (highest)
- Medium
- $500 (highest)
- Low
- –
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
15 targets across all 2 programs, each listed once with the programs that cover it. 5 excluded.
-
Elementor Pro, which sits inside Wordfence's "free and premium" wording even though it is not open source
Products and areas
Covered by Sorona
-
Install thresholds decide which classes count: 25 for the high-threat classes, 500 for stored cross-site scripting and SQL injection, and 500 to 50,000 for everything else depending on researcher tier. Elementor at over ten million installs clears every one of them.
Products and areas
Covered by Sorona
-
The free Elementor plugin as published on WordPress.org and at github.com/elementor/elementor, GPL-3.0-or-later, which is the open-source asset this listing rests on
Products and areas
Covered by Sorona
-
The plugin's whole product surface: the editor and its widget library, the markup those widgets render, dynamic tags, the form and file handlers, the template and kit import and export flows, and the AJAX and REST endpoints behind all of it
Products and areas
Covered by Sorona
-
Unauthenticated and low-privilege paths in particular, since the exploitability bar the program sets is what an anonymous visitor or a subscriber can reach
Products and areas
Covered by Sorona
-
Wordfence's declared scope is all WordPress plugins and themes, free and premium, at 25 or more active installations, minus whatever sits on its own out-of-scope asset list
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything requiring administrator, editor or shop-manager privileges to exploit, which the program places out of scope
Sorona
-
Anything requiring mid-level authentication, explicitly including the Contributor and Author roles
Sorona
-
Elementor's own hosted web properties, which belong to the vendor's separate Bugcrowd engagement and are not part of the plugin scope Wordfence pays for
Sorona
-
Plugins and themes below the active-install threshold for the class being reported, and any asset on Wordfence's own out-of-scope list
Sorona
-
Vulnerable dependencies that are not verifiably exploitable through the plugin itself
Sorona
Recent changes
Reward and scope changes across every Elementor program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Elementor products, from the NVD.
-
CVE-2025-8081 Medium
The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive informat
-
CVE-2025-8081 Medium
The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive informat
-
CVE-2025-3075 Medium
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
-
CVE-2025-3075 Medium
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
-
CVE-2025-3076 Medium
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
-
CVE-2025-3076 Medium
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
-
CVE-2025-1319 High
The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
-
CVE-2025-1319 High
The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
About this page
This page gathers every public program listed under elementor.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.