CVE-2026-6127: Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the elementordata meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the elementordata meta field with showinrest but omits a sanitizecallback, relying instead on a restpreinsertpost filter (sanitizepostdata function) that only sanitizes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the jsondecode() call on the raw body returns null, causing all sanitization to be skipped. The unsanitized data is then stored via updatepostmeta() and later output without escaping through multiple widget sinks including the HTML widget's printunescapedsetting() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
elementor/website-builderto a version that resolves this vulnerability.Fixed in 4.0.4 - Configuration
Update the Elementor plugin so that the _elementor_data meta field registered with show_in_rest includes a sanitize_callback and sanitization is applied even when form-encoded REST API PATCH requests cause json_decode() to return null.
Elementor Website Builder (WordPress REST API handling of _elementor_data meta) sanitize_callback for _elementor_data registered with show_in_rest = Add sanitize_callback (do not rely solely on rest_pre_insert_post sanitize_post_data); ensure sanitize_post_data correctly sanitizes form-encoded REST API request bodies (json_decode(raw_body) returning null must not skip sanitization)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6127?
CVE-2026-6127 is classified as a high severity vulnerability due to its potential for stored cross-site scripting exploits.
How do I fix CVE-2026-6127?
To mitigate CVE-2026-6127, update the Elementor Website Builder plugin to version 4.0.5 or later.
Who is affected by CVE-2026-6127?
CVE-2026-6127 affects users of the Elementor Website Builder plugin for WordPress versions up to and including 4.0.4.
What type of vulnerability is CVE-2026-6127?
CVE-2026-6127 is a stored cross-site scripting (XSS) vulnerability.
Can CVE-2026-6127 be exploited without authentication?
No, exploitation of CVE-2026-6127 requires an authenticated user with Contributor or higher privileges.