CVE-2026-104718

UNKNOWN 0.0

Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.

Vendor	unknown
Product	elementor website builder
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for unknown elementor website builder

Be the first to know when new unknown vulnerabilities affecting unknown elementor website builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Elementor Website Builder

0 < 4.3.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/1a429b80-13ef-4cd3-a18a-eef834d7b865/

Credits

Hung Bach Ngoc (@tomchuoi) WPScan