Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T13:17:23.137Z",
  "pubdate": "2026-11-06T13:17:23.137Z",
  "executiveSummary": "The Elementor Website Builder plugin for WordPress is susceptible to an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Cross-Site Scripting (XSS).\nThis vulnerability exists in versions from n/a through 4.3.5 and allows for arbitrary Code Injection.\nThe security flaw enables an attacker to inject malicious scripts into web pages rendered by the Elementor plugin, which are subsequently executed in the context of a victim's browser session.\nSuccessful exploitation poses a critical risk to site integrity and user data confidentiality, as it facilitates unauthorized actions, session hijacking, and the potential theft of administrative credentials.\nThe vulnerability requires no sophisticated infrastructure, though it is constrained by the attacker's ability to influence input fields processed by the plugin.\nOrganizations utilizing Elementor versions within the specified range are at elevated risk and should prioritize immediate mitigation.",
  "technicalDetails": "The vulnerability originates from a failure to adequately sanitize or escape user-supplied input before reflecting it within the generated HTML output of the Elementor Website Builder.\nThe root cause is the improper neutralization of input data during the page generation process, which allows an attacker to break out of the intended HTML context and inject arbitrary JavaScript.\nBy injecting malicious scripts into input fields that are later rendered by the plugin, an attacker can achieve Stored XSS. When an unsuspecting user or administrator views a page containing the injected payload, the malicious script executes within the victim's browser.\nThe attack flow involves: 1) The attacker identifying an input vector that is processed by the Elementor rendering engine without appropriate security filtering. 2) The attacker submits a crafted payload containing script tags or event handlers (e.g., onload, onerror). 3) The application stores this payload in the database. 4) The server reflects the malicious input in the rendered HTML output of the website when visited by other users.\nBecause the payload is stored and rendered upon request, the vulnerability does not necessarily require the attacker to have privileged access to the WordPress backend; rather, it exploits the trust mechanism between the server and the client browser.\nUpon execution, the payload operates with the permissions of the victim. If the victim is an administrator, the attacker could perform administrative actions, modify site content, create new rogue administrator accounts, or intercept sensitive data displayed on the page.\nThis vulnerability affects Elementor Website Builder versions n/a through 4.3.5. It facilitates Code Injection by bypassing the input validation layer, effectively turning the web page into a delivery mechanism for malicious scripts.\nPost-exploitation impact includes full session compromise, potential exfiltration of browser-based authentication tokens (such as session cookies), and unauthorized modification of the WordPress environment."
}