EUVD-2026-26479Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _elementor_data meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the _elementor_data meta field with show_in_rest but omits a sanitize_callback, relying instead on a rest_pre_insert_post filter (sanitize_post_data function) that only sanitizes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the json_decode() call on the raw body returns null, causing all sanitization to be skipped. The unsanitized data is then stored via update_post_meta() and later output without escaping through multiple widget sinks including the HTML widget's print_unescaped_setting() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in Elementor Website Builder plugin for WordPress up to version 4.0.4 allows authenticated contributors to inject arbitrary JavaScript via form-encoded REST API requests to the _elementor_data meta field. The vulnerability bypasses sanitization by exploiting a json_decode() failure on non-JSON request bodies, causing unsanitized data to be stored and later output without escaping in widget rendering functions. Contributors and above can inject malicious scripts that execute for all users viewing affected pages, compromising site integrity and user sessions.
Technical ContextAI
Elementor registers the _elementor_data post meta field with show_in_rest enabled but omits a sanitize_callback parameter. The plugin instead relies on a rest_pre_insert_post filter using sanitize_post_data() that only sanitizes JSON-encoded request bodies by calling json_decode(). When an attacker submits a form-encoded (application/x-www-form-urlencoded) PATCH request to the WordPress REST API endpoint for post meta, the json_decode() function on the raw body returns null, causing the sanitization logic to be completely bypassed. The unsanitized payload is then persisted via update_post_meta() as post metadata. During page rendering, multiple widget sinks output this data without HTML escaping, particularly through the HTML widget's print_unescaped_setting() function and other elementor/trunk/includes/base/widget-base.php sinks that fail to apply wp_kses_post() or equivalent output encoding. This is a classic stored XSS vulnerability (CWE-79: Cross-site Scripting) where insufficient input validation combines with missing output encoding.
RemediationAI
Update Elementor Website Builder to version 4.0.5 or later, which includes a fix implementing proper sanitize_callback on the _elementor_data meta field registration to validate form-encoded requests. For sites unable to immediately upgrade, implement the following compensating controls: restrict REST API access to authenticated users only via security plugin rules or .htaccess, limit contributor role capabilities to remove post editing permissions until patching is complete, disable WordPress REST API entirely if not required for site functionality (via Disable REST API plugin or wp-config.php constant), or use a Web Application Firewall (WAF) rule to block form-encoded PATCH requests to wp-json/wp/v2/posts endpoints. Note that disabling REST API may break Elementor frontend editing and Gutenberg functionality. The most reliable mitigation is prompt patching to 4.0.5+. Verify patch installation by checking plugin version in WordPress admin dashboard and inspecting elementor-post-meta.php for the presence of sanitize_callback parameter.
Stored Cross-Site Scripting in Elementor Website Builder plugin for WordPress allows authenticated attackers with Contri
The Elementor Website Builder plugin for WordPress contains an authorization bypass vulnerability in the is_allowed_to_r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today