---
id: "CVE-2026-104718"
page: "https://infrastack.ai/live/CVE-2026-104718"
kind: "vulnerability"
aliases: ["CVE-2026-104718"]
title: "Elementor WordPress plugin: contributors can store scripts that run in viewers' browsers"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["elementor", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "no-elementor"]
published_at: "2026-11-11T06:17:10+00:00"
first_seen_at: "2026-11-11T06:25:39+00:00"
updated_at: "2026-11-11T06:28:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104718", "first_seen_at": "2026-11-11T06:25:39+00:00"}]
exploit_sources: []
---

# Elementor WordPress plugin: contributors can store scripts that run in viewers' browsers

Link for people: https://infrastack.ai/live/CVE-2026-104718 (this .md is for agents)

Before version 4.3.6, the Elementor Website Builder WordPress plugin does not validate or escape an element identifier, so it is rendered into a client-side attribute that is evaluated as JavaScript. A user with the Contributor role can store a script that runs in the browser of anyone who views the content, including an administrator reviewing it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Elementor version in the WordPress admin plugin list or with `wp plugin get elementor --field=version`
- Treat any version below `4.3.6` as affected

## Fix

- Elementor Website Builder (WordPress plugin): `4.3.6`

## Timeline

- 2026-11-11T06:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104718

## From the sources

The Elementor Website Builder  WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_