{"id":"CVE-2026-109883","kind":"vulnerability","aliases":["CVE-2026-109883"],"related":[],"title":"Elementor Website Builder: cross-site scripting lets attackers inject code into pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.","summary":"Elementor Website Builder does not neutralize some input when generating web pages, which enables cross-site scripting and code injection. An attacker who gets a crafted input into a page can run scripts in the browsers of visitors or editors.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"elementor","fixed":["4.3.6"],"affected":"<= 4.3.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["elementor","runtime","web-builder","wordpress","xss"],"not_affected_if":["elementor-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the Elementor Website Builder version; 4.3.5 or lower is affected. Or run: wp plugin get elementor --field=version. Fixed in 4.3.6.","fix":"Update the Elementor Website Builder plugin to 4.3.6 or later (Patchstack lists 4.3.6 as patched).","status":"open","published_at":"2026-11-06T13:17:23+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","triaged_at":"2026-11-06T13:43:12+00:00","updated_at":"2026-11-06T13:44:10+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-06T13:43:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Elementor Website Builder: cross-site scripting lets attackers inject code into pages","impact":"medium","summary":"Elementor Website Builder does not neutralize some input when generating web pages, which enables cross-site scripting and code injection. An attacker who gets a crafted input into a page can run scripts in the browsers of visitors or editors.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["elementor","wordpress","web-builder"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitor or editor browsers; site content can be altered.","analyst_note":"Find the vendor advisory or patched Elementor version and the exact vulnerable input path (NVD link in sources does not state a fix).","how_to_check":"- Check the installed Elementor version in the WordPress plugins list or the `elementor` plugin header.\n- Compare the installed version against the affected range: through `4.3.5`.","plain_action":"","needs_analyst":true,"not_affected_if":["elementor-not-installed"],"who_is_affected":"Sites running Elementor Website Builder up to and including 4.3.5 are affected. The sources do not say which input or setting an attacker must reach, so whether a given site is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4217,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched Elementor version and the exact vulnerable input path (NVD link in sources does not state a fix).","search":"'-109883':16A,19A '-2026':15A,18A '4.3.5':99C 'affect':92C 'allow':88C 'attack':9A,50B 'browser':64B 'builder':3A,25B,30B,86C,95C 'code':11A,47B,89C 'craft':54B 'cross':5A,43B,78C 'cross-sit':4A,42B,77C 'cve':14A,17A 'editor':68B 'elementor':1A,20A,21B,28B,83C,84C,87C,93C 'enabl':41B 'generat':37B,76C 'get':52B 'improp':69C 'inject':10A,48B 'injection.this':90C 'input':35B,55B,72C 'issu':91C 'let':8A 'n/a':97C 'neutral':33B,70C 'page':13A,39B,58B,75C 'run':60B 'runtim':22B 'script':7A,45B,61B,80C 'site':6A,44B,79C 'visitor':66B 'vulner':81C 'web':24B,38B,74C 'web-build':23B 'websit':2A,29B,85C,94C 'wordpress':26B 'xss':27B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Elementor Website Builder plugin (free, slug elementor) version 4.3.5 or lower. Patchstack lists the issue as exploitable without logging in, but a privileged user, such as an admin, has to be tricked into clicking a link or visiting a crafted page. The exact vulnerable input is not stated in the source. Sites that do not use Elementor can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["elementor"],"ptokens":["elementor"],"labels":["elementor","high","runtime","webbuilder","wordpress","xss"],"campaign_type":null,"search_a":"'-109883':16A,19A '-2026':15A,18A 'attack':9A 'builder':3A 'code':11A 'cross':5A 'cross-sit':4A 'cve':14A,17A 'elementor':1A,20A 'inject':10A 'let':8A 'page':13A 'script':7A 'site':6A 'websit':2A","search_b":"'attack':50B 'browser':64B 'builder':25B,30B 'code':47B 'craft':54B 'cross':43B 'cross-sit':42B 'editor':68B 'elementor':21B,28B 'enabl':41B 'generat':37B 'get':52B 'inject':48B 'input':35B,55B 'neutral':33B 'page':39B,58B 'run':60B 'runtim':22B 'script':45B,61B 'site':44B 'visitor':66B 'web':24B,38B 'web-build':23B 'websit':29B 'wordpress':26B 'xss':27B","search_c":"'4.3.5':99C 'affect':92C 'allow':88C 'builder':86C,95C 'code':89C 'cross':78C 'cross-sit':77C 'elementor':83C,84C,87C,93C 'generat':76C 'improp':69C 'injection.this':90C 'input':72C 'issu':91C 'n/a':97C 'neutral':70C 'page':75C 'script':80C 'site':79C 'vulner':81C 'web':74C 'websit':85C,94C","first_public_at":"2026-11-06T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109883","severity":null,"published_at":"2026-11-06T13:17:23+00:00","modified_at":"2026-11-06T13:17:23+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","fetched_at":"2026-11-06T13:42:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109883:1894","url":"https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3","severity":null,"published_at":"2026-11-06T13:44:10+00:00","modified_at":"2026-11-06T13:44:10+00:00","first_seen_at":"2026-11-06T13:44:10+00:00","fetched_at":"2026-11-06T13:44:10+00:00","note":"Patchstack (CNA, third-party not vendor) page: <=4.3.5, fixed 4.3.6, unauthenticated, UI required, reporter fccsec.dev. Input path not stated; WPSec lists a separate unauthenticated reflected XSS (active-tab/active-document) fixed in 4.3.6, which may be this one but no source ties it to the CVE. No exploitation or PoC found. Nothing marked verified (no vendor page read).","cites":["https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3","https://wpsec.com/vuln/WPSEC-2026-2415/"]}],"documents":[{"id":86785,"url":"https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3","title":"Patchstack: Elementor <= 4.3.5 XSS (CVE-2026-109883)","kind":"advisory","source":"analyst","publisher":null,"text":"Vulnerable <= 4.3.5, patched 4.3.6. CVSS 7.1. Required privilege: Unauthenticated. User interaction required. Reported by fccsec.dev 6 Oct 2026; published 4 Nov 2026. Patchstack has a mitigation rule for its customers.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":86786,"url":"https://wpsec.com/vuln/WPSEC-2026-2415/","title":"WPSec: Elementor <= 4.3.5 reflected XSS via active-tab/active-document (possible sibling, CVE not stated)","kind":"other","source":"analyst","publisher":null,"text":"Affected 3.21.0 before 4.3.6; fixed 4.3.6 (released 2026-11-02). Unauthenticated reflected XSS via 'active-tab' and 'active-document' parameters in the Edit with Elementor link; needs a user such as an admin to be tricked.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}