High · 7.1 CVE-2026-109883 EUVD-2026-118224GHSA-p9qr-65fv-7r2g

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by Patchstack

Vendor: Elementor Product: Elementor Website Builder

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

Affected products

Vendor	Product	Affected	Fixed
Elementor	Elementor Website Builder	≤ 4.3.5	—

References

https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3?_s_id=cve vdb-entry