Elementor Still Includes Vulnerable Swiper: What CVE-2026-27212 Means for Your Site

Swiper is one of the most popular slider libraries on the web, and Elementor uses it in all of its carousels and galleries. In February 2026, Swiper developers patched a critical vulnerability CVE-2026-27212. However, even in mid-October, the latest Elementor version 4.3.5 still includes Swiper 8.4.5, which does not contain this fix.

We discovered this during our monthly security scans of client websites. In this article, we explain exactly what's broken, how serious the actual risk is, and what to do while waiting for Elementor to release a patch.

What is Swiper and why is it on your site

Swiper is a JavaScript library that powers draggable sliders: image carousels, testimonial slides, product galleries. Elementor includes it in its plugin (in the folder elementor/assets/lib/swiper/v8/) and loads it on pages where any of the slider widgets are used. If your site is built with Elementor, Swiper is likely there too, even if you've never heard of it.

What is the vulnerability

CVE-2026-27212 is a "prototype pollution" type vulnerability and is rated as critical in the GitHub Security Database. It affects Swiper versions from 6.5.1 through 12.1.1; the fix is available in version 12.1.2, released on February 18, 2026.

In simple terms: if an attacker can provide Swiper with specially crafted settings, they can modify JavaScript base objects in the browser. A previous fix checked for forbidden keywords, but this could be bypassed using arrays. The consequences depend on what else happens on the page, and in the worst case, it could open a path to malicious code execution in a visitor's browser.

Why hasn't Elementor fixed this yet

Elementor still uses Swiper version 8, and moving to the latest version (currently 14.x) would require major changes that could break existing sliders on thousands of sites. That's why the vulnerable version has remained in the plugin for roughly eight months. We checked on October 15: Elementor 4.3.5 and Elementor Pro 4.3.2 load swiper.min.js?ver=8.4.5.

How serious is the actual risk

Here's the good news. Elementor slider settings come from the editor, and only the site administrator or editor can change them. An ordinary outside visitor cannot affect them. To exploit this vulnerability through Elementor widgets, an attacker would already need access to the admin panel, and at that point they have many easier ways to damage the site.

So for most Elementor sites, the practical risk is low. The situation could be different if the site has other plugins or custom code that generates Swiper settings from URL parameters or user-submitted data.

What to do now

• Update Elementor and Elementor Pro to the latest versions. This won't solve the Swiper issue yet, but it closes others, such as CVE-2026-32475 in Elementor Pro file uploads.
• Secure administrator accounts: strong passwords and two-factor authentication for everyone with editor access. This is the main defense layer for this particular vulnerability.
• Check other plugins that use sliders. If any of them load their own copy of Swiper, make sure it's version 12.1.2 or newer.
• Don't manually patch the Swiper file. Elementor may not work with a newer Swiper version, and the next plugin update will overwrite your fix anyway.

How we found this

Every month, EvoEX runs automated security scans on client websites using OWASP ZAP, examining them from the outside just as a potential attacker would: checking for outdated libraries, missing security headers, and publicly exposed files. This time, it found Swiper 8.4.5. As soon as Elementor releases a version with the patched Swiper, our client websites will be updated, and the next scan will confirm it.

If you'd like to know whether your site has similar vulnerabilities, get in touch with us, and we'll check it for you.