CVE-2026-104718: Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID

Q: Who can exploit this issue, and who is at risk from the stored script?

A user with the WordPress Contributor role can store a malicious element identifier. The script executes in the browser of anyone who views the affected content, including an administrator reviewing it for publication.

Q: What does an attacker need to exploit it?

The attacker needs Contributor-level access to a WordPress site using the affected Elementor Website Builder plugin. Exploitation involves supplying a crafted element identifier that is rendered into a client-side framework attribute evaluated as JavaScript.

Q: Which versions are affected?

Elementor Website Builder versions before 4.3.6 are affected. Updating to version 4.3.6 or later removes the affected version range.

Published Nov 11, 2026

Updated

The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.

Affected Software

1 affected component

wordpress/elementor<4.3.6

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the stored script?

A user with the WordPress Contributor role can store a malicious element identifier. The script executes in the browser of anyone who views the affected content, including an administrator reviewing it for publication.

What does an attacker need to exploit it?

The attacker needs Contributor-level access to a WordPress site using the affected Elementor Website Builder plugin. Exploitation involves supplying a crafted element identifier that is rendered into a client-side framework attribute evaluated as JavaScript.

Which versions are affected?

Elementor Website Builder versions before 4.3.6 are affected. Updating to version 4.3.6 or later removes the affected version range.

CVE-2026-104718: Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the stored script?

What does an attacker need to exploit it?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the stored script?

What does an attacker need to exploit it?

Which versions are affected?