High · 7.1 CVE-2026-109884 EUVD-2026-118223GHSA-p6c5-g92j-3rmm

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by Patchstack

Vendor: Elementor Product: Elementor Website Builder

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

Affected products

Vendor	Product	Affected	Fixed
Elementor	Elementor Website Builder	≤ 4.3.5	—

References

https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve vdb-entry