{"id":"CVE-2026-104718","kind":"vulnerability","aliases":["CVE-2026-104718"],"related":[],"title":"Elementor WordPress plugin: contributors can store scripts that run in viewers' browsers","description":"The Elementor Website Builder  WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.","summary":"Before version 4.3.6, the Elementor Website Builder WordPress plugin does not validate or escape an element identifier, so it is rendered into a client-side attribute that is evaluated as JavaScript. A user with the Contributor role can store a script that runs in the browser of anyone who views the content, including an administrator reviewing it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","runtime","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","no-elementor"],"how_to_check":"- Check the installed Elementor version in the WordPress admin plugin list or with `wp plugin get elementor --field=version`\n- Treat any version below `4.3.6` as affected","fix":"- Elementor Website Builder (WordPress plugin): `4.3.6`","status":"open","published_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:28:03+00:00","updated_at":"2026-11-11T06:28:03+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T06:28:03Z","model":"claude-haiku-5-5","output":{"fix":"- Elementor Website Builder (WordPress plugin): `4.3.6`","reach":"internet","title":"Elementor WordPress plugin: contributors can store scripts that run in viewers' browsers","impact":"medium","summary":"Before version 4.3.6, the Elementor Website Builder WordPress plugin does not validate or escape an element identifier, so it is rendered into a client-side attribute that is evaluated as JavaScript. A user with the Contributor role can store a script that runs in the browser of anyone who views the content, including an administrator reviewing it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Scripts run in admin browsers, enabling session takeover and site changes","analyst_note":"","how_to_check":"- Check the installed Elementor version in the WordPress admin plugin list or with `wp plugin get elementor --field=version`\n- Treat any version below `4.3.6` as affected","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-elementor","no-contributor-accounts"],"who_is_affected":"Sites running the Elementor Website Builder WordPress plugin before 4.3.6 that allow Contributor-role users to create or edit content. The exposure comes from stored content, so an administrator reviewing a contributor's submission is also at risk. Sites without Elementor or with no Contributor-level accounts are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4564,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104718':15A,18A '-2026':14A,17A '4.3.6':27B,89C 'administr':80B,135C 'affect':131C 'allow':113C 'anyon':73B,128C 'attribut':51B,107C 'browser':12A,71B,126C 'builder':31B,85C 'client':49B,104C 'client-sid':48B,103C 'content':77B,132C 'contributor':4A,61B,117C 'cve':13A,16A 'element':40B,96C 'elementor':1A,19B,29B,83C 'escap':38B,94C 'evalu':54B,110C 'execut':123C 'framework':106C 'host':23B 'identifi':41B,97C 'includ':78B,133C 'javascript':56B,112C 'plugin':3A,33B,87C 'public':140C 'render':45B,99C 'review':81B,136C 'role':62B,118C 'run':9A,68B 'runtim':20B 'script':7A,66B,121C 'self':22B 'self-host':21B 'side':50B,105C 'store':6A,64B,120C 'submiss':138C 'user':58B,114C 'valid':36B,92C 'version':26B 'view':75B,129C 'viewer':11A 'websit':30B,84C 'wordpress':2A,24B,32B,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Elementor Website Builder WordPress plugin before 4.3.6 that allow Contributor-role users to create or edit content. The exposure comes from stored content, so an administrator reviewing a contributor's submission is also at risk. Sites without Elementor or with no Contributor-level accounts are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","runtime","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-104718':15A,18A '-2026':14A,17A 'browser':12A 'contributor':4A 'cve':13A,16A 'elementor':1A 'plugin':3A 'run':9A 'script':7A 'store':6A 'viewer':11A 'wordpress':2A","search_b":"'4.3.6':27B 'administr':80B 'anyon':73B 'attribut':51B 'browser':71B 'builder':31B 'client':49B 'client-sid':48B 'content':77B 'contributor':61B 'element':40B 'elementor':19B,29B 'escap':38B 'evalu':54B 'host':23B 'identifi':41B 'includ':78B 'javascript':56B 'plugin':33B 'render':45B 'review':81B 'role':62B 'run':68B 'runtim':20B 'script':66B 'self':22B 'self-host':21B 'side':50B 'store':64B 'user':58B 'valid':36B 'version':26B 'view':75B 'websit':30B 'wordpress':24B,32B","search_c":"'4.3.6':89C 'administr':135C 'affect':131C 'allow':113C 'anyon':128C 'attribut':107C 'browser':126C 'builder':85C 'client':104C 'client-sid':103C 'content':132C 'contributor':117C 'element':96C 'elementor':83C 'escap':94C 'evalu':110C 'execut':123C 'framework':106C 'identifi':97C 'includ':133C 'javascript':112C 'plugin':87C 'public':140C 'render':99C 'review':136C 'role':118C 'script':121C 'side':105C 'store':120C 'submiss':138C 'user':114C 'valid':92C 'view':129C 'websit':84C 'wordpress':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104718","severity":null,"published_at":"2026-11-11T06:17:10+00:00","modified_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}