CVE-2026-109884: WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Elementor Website Builder pluginto a version that resolves this vulnerability.Fixed in 4.3.6
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must induce a user to interact with a crafted request or page, as indicated by the required user interaction. No authentication is required for the attacker.
Which installations are affected?
Elementor Website Builder versions through 4.3.5 are affected. The provided information does not identify a safe fixed version or any configuration prerequisite.
What is the potential impact if exploitation succeeds?
Successful reflected XSS can affect confidentiality, integrity, and availability at low impact levels. The vulnerability has scope changed, meaning effects may extend beyond the vulnerable component's own security authority.