Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-120850 EUVD-2026-119108GHSA-rrhh-58qh-jxcq

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Published Nov 7, 2026 · Updated Nov 7, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

Affected products

VendorProductAffectedFixed
Elementor Elementor Website Builder ≤ 4.3.5 —

References