EUVD-2026-11839Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-Based XSS.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
AnalysisAI
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowing authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. An attacker can exploit this via a crafted page or element to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), but carries a moderate CVSS score of 6.5 with cross-site impact (S:C), indicating meaningful business risk despite not being unauthenticated.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a DOM-based variant where user-controlled input is inadequately sanitized before being rendered into the page's Document Object Model. Elementor Website Builder is a WordPress page builder plugin (CPE identifier: cpe:2.3:a:elementor:elementor) that dynamically generates web content and page elements. DOM-based XSS differs from reflected/stored XSS in that the attack payload is processed client-side by JavaScript, often through unsafe DOM methods like innerHTML, eval(), or document.write(). In Elementor's case, the builder likely fails to properly escape or validate user-supplied widget data, template variables, or custom code before injecting them into the DOM during page rendering, allowing an attacker to break out of intended context and execute arbitrary JavaScript.
RemediationAI
Immediately upgrade Elementor Website Builder to version 3.36.0 or later, which contains the XSS fix. In the WordPress admin dashboard, navigate to Plugins > Updates and click 'Update Now' for Elementor, or upload the patched version manually. Until patching can be completed, implement the following interim controls: (1) restrict the 'elementor_edit_others_posts' and 'elementor_edit_posts' capabilities to trusted administrators only via user role management plugins; (2) enable WordPress security plugins (e.g., Wordfence, Sucuri) to monitor for suspicious DOM-based XSS patterns in editor activity; (3) review and disable any custom code widgets or third-party Elementor addons that may introduce additional XSS vectors. Test the upgrade in a staging environment first to ensure compatibility with custom templates and plugins. Consult the official Elementor security advisory at https://elementor.com/security/ for any additional guidance or rollback procedures.
More in Elementor Website Builder
View allInformation disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users wit
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenti
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPre
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today