Elementor Website Builder: Stored Cross-Site Scripting via Element ID
Summary
The Elementor Website Builder WordPress plugin does not validate or escape an element identifier before rendering it into a client-side attribute that is evaluated as JavaScript. A user with the Contributor role can store scripts that run in the browser of anyone viewing the content, including an administrator reviewing it for publication. Exploitation requires a Contributor-level account and user interaction, and the CVSS vector in the record is provisional.
Affected
- Elementor Website Builder WordPress plugin from 0 before 4.3.6 (per CNA WPScan).
- VulDB describes the range as up to 4.3.5. The exact range is to be confirmed against the WPScan advisory.
Fixed in
- Version 4.3.6.
- No dedicated vendor security advisory found. The changelog entries are generic.
Workaround
- No vendor or researcher workaround found.
- Interim measure: limit or temporarily suspend Contributor-level accounts, and have editors check Contributor submissions in code view for unexpected script content before publishing.
Exploitation
- Not listed in CISA KEV.
- No public proof of concept found. The WPScan reference is tagged as exploit, but its content could not be verified.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- In the wild: unknown.
Our recommendation
- Update Elementor to 4.3.6 or later on all WordPress sites.
- Review Contributor and higher accounts and remove unused ones.
- Until patched, restrict Contributor accounts and have editors inspect submissions in code view before publishing.
- Confirm the affected range and CVSS score against the WPScan advisory and NVD.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record (CVE Program) www.cve.org
- WPScan vulnerability advisory wpscan.com
- VulDB entry CVE-2026-104718 vuldb.com
- Elementor 4.3.6 release on GitHub github.com
- Elementor changelog (raw) raw.githubusercontent.com
- OpenCVE entry CVE-2026-104718 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:36.
Original description (NVD)
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.