ELEMENTOR · CVE-2026-109883 · Runtime
FIX → 4.3.6
Elementor Website Builder does not neutralize some input when generating web pages, which enables cross-site scripting and code injection. An attacker who gets a crafted input into a page can run scripts in the browsers of visitors or editors.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress sites running the Elementor Website Builder plugin (free, slug elementor) version 4.3.5 or lower. Patchstack lists the issue as exploitable without logging in, but a privileged user, such as an admin, has to be tricked into clicking a link or visiting a crafted page. The exact vulnerable input is not stated in the source. Sites that do not use Elementor can skip it.
Not affected if elementor-not-installed
Who cares elementor, web-builder, wordpress, xss
4.3.5 or lower is affected4.3.6Upgrade to 4.3.6
Update the Elementor Website Builder plugin to 4.3.6 or later (Patchstack lists 4.3.6 as patched).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.