Elementor Website Builder CVE-2026-109884

Exploitation requires an attacker-crafted request/URL to be followed by a victim (UI:R) - reflected XSS is not triggered by normal browsing and cannot self-propagate, so successful attacks depend on social engineering to get a logged-in or targeted user to click. The affected component is the Elementor Website Builder plugin on WordPress at version 4.3.5 or earlier; the specific input parameter or feature that fails to neutralize the payload is not stated in the available source. Impact is scoped to the victim's browser session context (session/cookie theft, actions as the clicking user) rather than direct server compromise. Limiting factors: mandatory user interaction, dependence on the victim's privilege level for meaningful impact, and the need for the victim to reach the crafted request on a vulnerable site.

This is a reflected cross-site scripting flaw (CWE-79) in the Elementor Website Builder WordPress plugin, affecting versions up to and including 4.3.5. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) indicates network-reachable, low-complexity, no-privilege exploitation, but with a mandatory user-interaction requirement (UI:R) that is the single most important limiter here: reflected XSS is not self-propagating and cannot be triggered against a default page view - a victim must be lured into following an attacker-crafted request. The Changed scope (S:C) and triple Low impact inflate the base score to 7.1; a more conventional reflected-XSS scoring would yield ~6.1. No EPSS probability was provided, so exploitation likelihood cannot be quantified from the data. The CVE is not listed in CISA KEV and no public exploit was identified in the input - the only reference is the Patchstack advisory, which is a vulnerability-database entry rather than verified working exploit code. The vuln.today decision label is 'this_week', consistent with a moderate, non-emergency priority. Net assessment: a credible, broadly-exposed issue because of Elementor's enormous install base, but real-world risk is bounded by the user-interaction requirement and the limited (Low) confidentiality/integrity impact typical of reflected XSS - treat as routine timely patching, not an incident-grade emergency.

An attacker crafts a URL containing a malicious script payload in a parameter processed by the Elementor plugin and delivers it to a WordPress site user (for example an administrator) via phishing or a planted link. When the victim clicks the link, the payload is reflected back and executed in their authenticated browser session, enabling session/cookie theft or actions performed as that user. No public exploit code was identified in the input; the exact vulnerable parameter and trigger are not described in the available source.