CVE-2026-109883: WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

Elementor Website Builder versions through 4.3.5 are affected. The available data does not specify a lower affected version or whether any particular configuration is excluded.

Q: What does exploitation require?

The vector is network-accessible, requires low attack complexity, does not require privileges, and requires user interaction. Successful exploitation can affect confidentiality, integrity, and availability at low impact, with scope changed.

Q: How can I determine whether my site is exposed?

Check whether the site uses the Elementor Website Builder plugin and identify its installed version. An installation at version 4.3.5 or earlier should be treated as affected based on the available information.

Published Nov 6, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Elementor Website Builder plugin to a version that resolves this vulnerability.
Fixed in 4.3.6

Event History

Nov 6, 2026

CVE Published

via MITRE·12:09 PM

Data Sourced

via MITRE·12:09 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Elementor Website Builder versions through 4.3.5 are affected. The available data does not specify a lower affected version or whether any particular configuration is excluded.

What does exploitation require?

The vector is network-accessible, requires low attack complexity, does not require privileges, and requires user interaction. Successful exploitation can affect confidentiality, integrity, and availability at low impact, with scope changed.

How can I determine whether my site is exposed?

Check whether the site uses the Elementor Website Builder plugin and identify its installed version. An installation at version 4.3.5 or earlier should be treated as affected based on the available information.

CVE-2026-109883: WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does exploitation require?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does exploitation require?

How can I determine whether my site is exposed?