Elementor Website Builder EUVD-2026-118224

Exploitation requires a victim to load the page containing the injected payload (UI:R) - the flaw cannot produce impact passively. The exact Elementor input, widget, or feature that fails input neutralization is not described in the available sources. The supplied CVSS vector indicates no privileges (PR:N), but the privilege level is not independently confirmed and may in practice require authenticated (e.g. Contributor-level) access, which is a common limiter for Elementor XSS; verify with the Patchstack advisory. Exploitation is limited to Elementor Website Builder versions up to and including 4.3.5.

This is a medium-to-high severity stored/reflected cross-site scripting issue (CVSS 7.1) rated CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - network-reachable, low complexity, no privileges in the supplied vector, but requiring user interaction (UI:R) and with a changed scope (S:C) reflecting execution in the victim's browser authority. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious but non-crisis issue. No EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing (not actively exploited) and the only reference is the Patchstack advisory, not working exploit code. The UI:R requirement is the main real-world dampener: an attacker cannot gain impact without a victim loading the affected page. One caveat worth verifying: the supplied vector states PR:N (unauthenticated), yet Elementor XSS flaws reported through Patchstack are frequently Contributor+ authenticated stored XSS - the privilege requirement should be confirmed with the vendor/Patchstack advisory before treating this as fully unauthenticated. Overall a genuine priority to patch within the normal cycle, not an emergency.

An attacker places a crafted script payload into an Elementor input that is not properly neutralized during web page generation; when another user or administrator subsequently views the page, the script executes in their browser session under the site's origin, enabling session/content manipulation. Exploitation depends on a victim loading the affected page (UI:R). No public exploit code was identified - only the Patchstack advisory reference.