{"id":"CVE-2026-120850","kind":"vulnerability","aliases":["CVE-2026-120850"],"related":[],"title":"Elementor Website Builder: stored XSS through page content up to 4.3.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.","summary":"Elementor Website Builder, a WordPress page builder plugin, has a stored cross-site scripting flaw in versions through 4.3.5. An attacker who can get content saved into a page can run script in the browser of anyone who views it.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Elementor version in the WordPress admin plugin list, or with `wp plugin get elementor --field=version`\n- Compare the result with the fixed version: unknown","fix":null,"status":"open","published_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:29+00:00","updated_at":"2026-11-07T10:48:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T10:48:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Elementor Website Builder: stored XSS through page content up to 4.3.5","impact":"medium","summary":"Elementor Website Builder, a WordPress page builder plugin, has a stored cross-site scripting flaw in versions through 4.3.5. An attacker who can get content saved into a page can run script in the browser of anyone who views it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed Elementor version and the exact role needed to store the payload, from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed Elementor version in the WordPress admin plugin list, or with `wp plugin get elementor --field=version`\n- Compare the result with the fixed version: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Elementor Website Builder plugin at version 4.3.5 or earlier are in the stated range. Exposure depends on who can save content into pages, so sites where only trusted editors write content carry less risk. unknown for the exact preconditions beyond the description.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4219,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120850':14A,17A '-2026':13A,16A '4.3.5':11A,43B,94C 'affect':87C 'allow':83C 'anyon':61B 'attack':45B 'browser':59B 'builder':3A,26B,30B,81C,90C 'content':8A,49B 'cross':36B,73C 'cross-sit':35B,72C 'cve':12A,15A 'elementor':1A,18B,24B,78C,79C,82C,88C 'flaw':39B 'generat':71C 'get':48B 'host':22B 'improp':64C 'input':67C 'issu':86C 'n/a':92C 'neutral':65C 'packag':19B 'page':7A,29B,53B,70C 'plugin':31B 'run':55B 'save':50B 'script':38B,56B,75C 'self':21B 'self-host':20B 'site':37B,74C 'store':4A,34B,84C 'version':41B 'view':63B 'vulner':76C 'web':69C 'websit':2A,25B,80C,89C 'wordpress':23B,28B 'xss':5A 'xss.this':85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Elementor Website Builder plugin at version 4.3.5 or earlier are in the stated range. Exposure depends on who can save content into pages, so sites where only trusted editors write content carry less risk. unknown for the exact preconditions beyond the description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120850':14A,17A '-2026':13A,16A '4.3.5':11A 'builder':3A 'content':8A 'cve':12A,15A 'elementor':1A 'page':7A 'store':4A 'websit':2A 'xss':5A","search_b":"'4.3.5':43B 'anyon':61B 'attack':45B 'browser':59B 'builder':26B,30B 'content':49B 'cross':36B 'cross-sit':35B 'elementor':18B,24B 'flaw':39B 'get':48B 'host':22B 'packag':19B 'page':29B,53B 'plugin':31B 'run':55B 'save':50B 'script':38B,56B 'self':21B 'self-host':20B 'site':37B 'store':34B 'version':41B 'view':63B 'websit':25B 'wordpress':23B,28B","search_c":"'4.3.5':94C 'affect':87C 'allow':83C 'builder':81C,90C 'cross':73C 'cross-sit':72C 'elementor':78C,79C,82C,88C 'generat':71C 'improp':64C 'input':67C 'issu':86C 'n/a':92C 'neutral':65C 'page':70C 'script':75C 'site':74C 'store':84C 'vulner':76C 'web':69C 'websit':80C,89C 'xss.this':85C","first_public_at":"2026-11-07T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120850","severity":null,"published_at":"2026-11-07T10:17:10+00:00","modified_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}