CVE-2026-11767
CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form
CVSS Score
8.8
EPSS Score
0.2%
EPSS Percentile
7th
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
| Vendor | unknown |
| Product | free theme builder for elementor |
| Published | Jul 21, 2026 |
| Last Updated | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown free theme builder for elementor
Be the first to know when new high vulnerabilities affecting unknown free theme builder for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Free Theme Builder for Elementor
0 < 1.6.7
References
Credits
hitarth shah WPScan