---
id: "CVE-2026-109883"
page: "https://infrastack.ai/live/CVE-2026-109883"
kind: "vulnerability"
aliases: ["CVE-2026-109883"]
title: "Elementor Website Builder: cross-site scripting lets attackers inject code into pages"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "elementor", "fixed": ["4.3.6"], "affected": "<= 4.3.5", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["elementor", "runtime", "web-builder", "wordpress", "xss"]
not_affected_if: ["elementor-not-installed"]
published_at: "2026-11-06T13:17:23+00:00"
first_seen_at: "2026-11-06T13:42:19+00:00"
updated_at: "2026-11-06T13:44:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109883", "first_seen_at": "2026-11-06T13:42:19+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3", "first_seen_at": "2026-11-06T13:44:10+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3", "https://wpsec.com/vuln/WPSEC-2026-2415/"]}]
exploit_sources: []
---

# Elementor Website Builder: cross-site scripting lets attackers inject code into pages

Link for people: https://infrastack.ai/live/CVE-2026-109883 (this .md is for agents)

Elementor Website Builder does not neutralize some input when generating web pages, which enables cross-site scripting and code injection. An attacker who gets a crafted input into a page can run scripts in the browsers of visitors or editors.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:elementor affected <= 4.3.5 fixed 4.3.6

## How to check

In WordPress admin > Plugins, check the Elementor Website Builder version; 4.3.5 or lower is affected. Or run: wp plugin get elementor --field=version. Fixed in 4.3.6.

## Fix

Update the Elementor Website Builder plugin to 4.3.6 or later (Patchstack lists 4.3.6 as patched).

## Timeline

- 2026-11-06T13:42:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109883
- 2026-11-06T13:44:10+00:00 analyst https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3 — Patchstack (CNA, third-party not vendor) page: <=4.3.5, fixed 4.3.6, unauthenticated, UI required, reporter fccsec.dev. Input path not stated; WPSec lists a separate unauthenticated reflected XSS (active-tab/active-document) fixed in 4.3.6, which may be this one but no source ties it to the CVE. No exploitation or PoC found. Nothing marked verified (no vendor page read).

## Documents

- [advisory] Patchstack: Elementor <= 4.3.5 XSS (CVE-2026-109883) https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-5-cross-site-scripting-xss-vulnerability-3
- [mentions] WPSec: Elementor <= 4.3.5 reflected XSS via active-tab/active-document (possible sibling, CVE not stated) https://wpsec.com/vuln/WPSEC-2026-2415/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_