Free Theme Builder for Elementor CVE-2026-11767

Exploitation requires the target WordPress site to run Free Theme Builder for Elementor before 1.6.7 with a public-facing contact form provided by the plugin; the attacker submits a crafted value into a contact form field, no authentication needed (PR:N). The decisive LIMITING factor is user interaction (UI:R): the payload only fires when a logged-in administrator opens the form-submissions view in the admin dashboard - it does not self-trigger. There are no privilege or configuration prerequisites for injection, but exploitation is bounded by the presence of an active plugin-provided form and an admin who reviews submissions.

Signals conflict, so prioritize with care. The NVD CVSS of 8.8 with C:H/I:H/A:H overstates the direct impact of a stored XSS: for a script executing in an admin's browser, confidentiality/integrity impact is realistically partial (session/action abuse) rather than total system compromise, and availability impact is doubtful - the vector's H/H/H ratings look inflated for this bug class. Countervailing signals point to lower urgency: EPSS is only 0.17% (7th percentile), SSVC exploitation status is 'none' and automatable is 'no', meaning no observed automated exploitation. The mitigating factor is real: exploitation requires an administrator to view the malicious submission (UI:R). Conversely, SSVC technical impact is rated 'total' and public POC code exists, so a successful hit against an active admin could be serious. Net: a genuine, patchable issue worth remediating in normal cycles, but not an emergency - this is a high-CVSS/low-real-world-probability case, not a KEV-grade threat.

An anonymous attacker submits the site's public contact form with a field value containing a JavaScript payload (e.g., an event-handler-laden HTML string) instead of normal text. The plugin stores the value verbatim; when an administrator later opens the form submissions in wp-admin, the script executes in their authenticated session, allowing the attacker to steal cookies, forge admin requests (create users, install plugins), or pivot to full site takeover. Publicly available POC code from WPScan demonstrates the injection; the network attack vector and low complexity make the injection trivial, with the only gate being that an admin must view the submission.