Elementor

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Per-vulnerability maximum, standard researcher (the 1337 tier is higher and invite-only) │ $31,200 │ $32,200 Minimum bounty award │ $5 │ $6 Submit a vulnerability CVE history 396 Last 12 months 1,613 Lifetime XSS 50 % Access control 25 % Code execution 15 % Info disclosure 8 % Latest advisories Loading the feed Overview Elementor is the dominant WordPress page builder, recorded by the WordPress.org plugin API at over 10,000,000 active installations, and every one of those installations is a self-hosted site rather than a managed tenant — so a defect here is mass-exploitable across an enormous long tail of sites nobody is watching. Who pays for it is the strange part: Elementor runs its own paid Bugcrowd program, that program's in-scope list is exactly eight web properties, and the GPL plugin appears nowhere on it. The plugin is nonetheless one of the best-paying open-source targets anywhere, because two independent WordPress security marketplaces pay for it out of their own commercial threat-intelligence businesses. Wordfence Intelligence covers "all WordPress plugins and themes, free and premium" above an active-install threshold, and Elementor at ten million installs clears every threshold in the table; its per-vulnerability bounty reaches $31,200 for a standard researcher, on top of monthly streak bonuses that run from $35 for five valid submissions to $1,000 for fifty. Read the CVE counts on this card with the caveat the research carries: the NVD keyword elementor matches the whole third-party "for Elementor" addon ecosystem, so those figures describe the ecosystem rather than the core plugin alone. sorona.xyz adds 1.25× on top of whatever the program awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Wordfence's declared scope is all WordPress plugins and themes, free and premium, at 25 or more active installations, minus whatever sits on its own out-of-scope asset list The free Elementor plugin as published on WordPress.org and at github.com/elementor/elementor , GPL-3.0-or-later, which is the open-source asset this listing rests on Elementor Pro, which sits inside Wordfence's "free and premium" wording even though it is not open source The plugin's whole product surface: the editor and its widget library, the markup those widgets render, dynamic tags, the form and file handlers, the template and kit import and export flows, and the AJAX and REST endpoints behind all of it Install thresholds decide which classes count: 25 for the high-threat classes, 500 for stored cross-site scripting and SQL injection, and 500 to 50,000 for everything else depending on researcher tier. Elementor at over ten million installs clears every one of them. Unauthenticated and low-privilege paths in particular, since the exploitability bar the program sets is what an anonymous visitor or a subscriber can reach Out of scope Anything requiring administrator, editor or shop-manager privileges to exploit, which the program places out of scope Anything requiring mid-level authentication, explicitly including the Contributor and Author roles Plugins and themes below the active-install threshold for the class being reported, and any asset on Wordfence's own out-of-scope list Vulnerable dependencies that are not verifiably exploitable through the plugin itself Elementor's own hosted web properties, which belong to the vendor's separate Bugcrowd engagement and are not part of the plugin scope Wordfence pays for Most-valued findings Unauthenticated remote code execution or arbitrary PHP file upload reachable from a default install: this is the top of the high-threat list, it qualifies from 25 installs upward, and on ten million self-hosted sites it is the finding that justifies the $31,200 per-vulnerability ceiling Authentication bypass or privilege escalation to administrator, which is the other half of the high-threat band and the class the program most wants because it converts a visitor into full site control Unauthenticated or subscriber-level stored XSS in a widget's render path, the single largest class in this ecosystem at roughly half of all advisories, and worth filing precisely because the privilege bar is where the program draws its line SQL injection through a widget, dynamic-tag or AJAX handler that reaches the database with attacker-controlled input, priced in the same band as stored XSS and far rarer Arbitrary options update or missing capability checks on an AJAX or REST endpoint, the access-control class at roughly a quarter of the history, which usually chains straight into administrator takeover Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Route through Wordfence, not Patchstack: Patchstack's guidelines permanently ban and delete the accounts of researchers who report a vulnerability to any third party, so a Patchstack-routed finding risks the whole award rather than just an embargo Active-install thresholds gate what counts: 25 installs for high-threat classes, 500 for stored XSS and SQL injection, and between 500 and 50,000 for everything else depending on your researcher tier Anything that needs administrator, editor or shop-manager privileges to exploit is out of scope, and so is anything needing Contributor or Author: the program excludes findings requiring PR:H and mid-level authentication alike Wordfence publishes no per-severity ladder: the figures are a per-vulnerability maximum, a $5 minimum award, and monthly streak bonuses paid on the 1st and 15th of each month The $32,760 per-vulnerability figure belongs to the invite-only "1337" researcher tier; $31,200 is the ceiling a standard researcher can reach Disclosure Coordinated through Wordfence, which triages the report, works the fix with the plugin vendor and publishes its own advisory once a patched release is out. Because the competing marketplace covering the same scope treats reporting to a third party as grounds for a permanent ban, file with Wordfence yourself first and send sorona.xyz the submission reference rather than the finding. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability