What is the CVSS score of CVE-2026-11767?

CVE-2026-11767 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Free Theme Builder for Elementor are affected by CVE-2026-11767?

Free Theme Builder for Elementor WordPress plugin versions before 1.6.7 contains a stored XSS vulnerability allowing attackers to compromise administrator accounts through contact form submissions.. A patch is available.

Is there a public PoC exploit available for CVE-2026-11767?

Yes, a public proof-of-concept exploit is available for CVE-2026-11767. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-11767?

Within 24 hours, audit WordPress installations for Free Theme Builder versions prior to 1.6.7 and review recent contact form submissions for suspicious content. Within 7 days, update all affected installations to version 1.6.7 or later and review administrator session logs for anomalies during submission review periods. Within 30 days, implement content security policy headers across affected WordPress sites and conduct administrator security awareness training on form data validation risks.

Free Theme Builder for Elementor CVE-2026-11767

EUVD-2026-46159 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 WPScan

GHSA-9g9m-xxjx-jx22

XSS WordPress Free Theme Builder For Elementor

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Unauthenticated injection over the network (PR:N/AV:N/AC:L) but requires an admin to view submissions (UI:R); script crosses into the admin security context (S:C) with partial confidentiality/integrity impact typical of XSS and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:27 vuln.today

Patch available

Jul 21, 2026 - 08:02 EUVD

CVE Published

Jul 21, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Jul 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

AnalysisAI

Stored cross-site scripting in the Free Theme Builder for Elementor WordPress plugin before 1.6.7 lets unauthenticated attackers inject malicious script through contact form field values, which are stored unsanitized and later rendered in the admin dashboard's form-submissions view. The payload executes in the browser of any logged-in administrator who reviews submissions, enabling session hijacking or actions in the admin's context. Publicly available exploit code exists (WPScan), but there is no evidence of active exploitation and EPSS probability is low (0.17%).

Technical ContextAI

The affected component is a WordPress plugin that adds theme-building and contact-form capabilities to the Elementor page builder ecosystem. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): submitted contact-form field values are persisted to the database and echoed back into the wp-admin submissions listing without output encoding or input sanitization. Because the sink is the authenticated admin dashboard while the source is an anonymous front-end form, this is a classic stored/persistent XSS where a low-privileged (unauthenticated) actor plants a payload that later fires in a high-privileged context. CPE cpe:2.3:a:unknown:free_theme_builder_for_elementor:*:*:*:*:*:*:*:* identifies the affected package; note the NVD description text calls it 'Free Builder for Elementor' while the CPE, tags, and EUVD consistently name it 'Free Theme Builder for Elementor'.

RemediationAI

Upgrade the Free Theme Builder for Elementor plugin to version 1.6.7 or later - Vendor-released patch: 1.6.7 resolves the stored XSS. If immediate patching is not possible, apply specific compensating controls: temporarily deactivate the plugin's contact form functionality or the plugin itself (side effect: front-end forms and theme-building features stop working); restrict access to the wp-admin form-submissions page so only trusted administrators view it, and avoid opening unreviewed submissions until patched; and deploy a WAF rule to strip or encode script/HTML in form field submissions (side effect: may reject legitimate input containing angle brackets). A Content-Security-Policy that disallows inline script in wp-admin further reduces payload execution but can break other admin plugins. Reference the WPScan advisory (https://wpscan.com/vulnerability/e06a6497-e44f-43b9-b6ba-407aea171387/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-11767) for details.