Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T13:17:23.300Z",
  "pubdate": "2026-11-06T13:17:23.300Z",
  "executiveSummary": "The Elementor Website Builder plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper neutralization of user-supplied input during the web page generation process, allowing an attacker to inject arbitrary client-side scripts into the browser sessions of victim users.\nThis vulnerability impacts Elementor Website Builder versions from n/a through 4.3.5. By successfully exploiting this weakness, an unauthorized actor can execute malicious JavaScript within the context of an authenticated user's session. The implications of such an exploit include unauthorized data access, session hijacking, defacement of the affected website, and potential redirection of users to malicious third-party domains.\nExploitation typically requires the victim to interact with a crafted link containing a malicious payload. Given the nature of reflected XSS, the attack is non-persistent but remains highly effective for targeted campaigns against administrators or high-privilege users. Mitigation is essential to prevent compromise of site integrity and user trust.",
  "technicalDetails": "The vulnerability is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The root cause lies in the application's failure to adequately sanitize or encode user-provided input parameters before reflecting them within the HTTP response body. When a web application fails to treat user-controlled data as untrusted content, the browser may interpret injected scripts as legitimate code originating from the trusted domain.\nIn the context of Elementor Website Builder, the attack vector involves an attacker crafting a specialized URL containing a malicious JavaScript payload. This payload is passed through an unsanitized input parameter processed by the plugin. When an unsuspecting user, such as an administrator, clicks on the maliciously constructed link, the server processes the input and includes the attacker-supplied script directly into the generated HTML response. Consequently, the user's browser executes the script under the security context of the origin site.\nThe attack flow follows a structured sequence: First, the attacker identifies a URL parameter or input field processed by Elementor that lacks sufficient output encoding. Second, the attacker encodes a malicious payload (e.g., document.cookie theft or site redirection scripts) into the URL. Third, the attacker distributes this link to a target. Once the victim triggers the request, the server reflects the payload in the server response. Finally, the victim's browser executes the script, granting the attacker the ability to perform actions on behalf of the victim or exfiltrate sensitive session identifiers.\nThis Reflected XSS vulnerability does not strictly require the attacker to have administrative privileges on the target WordPress instance, as the impact is realized on the client-side of the target victim. However, the severity is amplified if the victim possesses high-level privileges, as the executed script can interact with administrative APIs or modify site configurations. The vulnerability is network-accessible, meaning any user who can reach the web server can theoretically initiate the exploit if they can induce a victim to perform the malicious request."
}