CVE-2026-109884 · Package
NO FIX YET · SEE WHAT TO DO
Elementor Website Builder through version 4.3.5 fails to sanitize input in generated pages, allowing reflected cross-site scripting. An attacker can get script to run in a visitor's browser if that visitor opens a crafted link.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Elementor Website Builder plugin at version 4.3.5 or earlier are in the affected range according to the NVD description. Reflected XSS usually requires a victim to open a crafted link, so exposure depends on whether the site is publicly reachable and whether users follow links. Sites that do not run Elementor are not affected.
Not affected if plugin-not-installed
Who cares elementor, self-hosted, wordpress
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.