EUVD-2026-26479Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _elementor_data meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the _elementor_data meta field with show_in_rest but omits a sanitize_callback, relying instead on a rest_pre_insert_post filter (sanitize_post_data function) that only sanitizes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the json_decode() call on the raw body returns null, causing all sanitization to be skipped. The unsanitized data is then stored via update_post_meta() and later output without escaping through multiple widget sinks including the HTML widget's print_unescaped_setting() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in Elementor Website Builder plugin for WordPress up to version 4.0.4 allows authenticated contributors to inject arbitrary JavaScript via form-encoded REST API requests to the _elementor_data meta field. The vulnerability bypasses sanitization by exploiting a json_decode() failure on non-JSON request bodies, causing unsanitized data to be stored and later output without escaping in widget rendering functions. Contributors and above can inject malicious scripts that execute for all users viewing affected pages, compromising site integrity and user sessions.
Technical ContextAI
Elementor registers the _elementor_data post meta field with show_in_rest enabled but omits a sanitize_callback parameter. The plugin instead relies on a rest_pre_insert_post filter using sanitize_post_data() that only sanitizes JSON-encoded request bodies by calling json_decode(). When an attacker submits a form-encoded (application/x-www-form-urlencoded) PATCH request to the WordPress REST API endpoint for post meta, the json_decode() function on the raw body returns null, causing the sanitization logic to be completely bypassed. The unsanitized payload is then persisted via update_post_meta() as post metadata. During page rendering, multiple widget sinks output this data without HTML escaping, particularly through the HTML widget's print_unescaped_setting() function and other elementor/trunk/includes/base/widget-base.php sinks that fail to apply wp_kses_post() or equivalent output encoding. This is a classic stored XSS vulnerability (CWE-79: Cross-site Scripting) where insufficient input validation combines with missing output encoding.
RemediationAI
Update Elementor Website Builder to version 4.0.5 or later, which includes a fix implementing proper sanitize_callback on the _elementor_data meta field registration to validate form-encoded requests. For sites unable to immediately upgrade, implement the following compensating controls: restrict REST API access to authenticated users only via security plugin rules or .htaccess, limit contributor role capabilities to remove post editing permissions until patching is complete, disable WordPress REST API entirely if not required for site functionality (via Disable REST API plugin or wp-config.php constant), or use a Web Application Firewall (WAF) rule to block form-encoded PATCH requests to wp-json/wp/v2/posts endpoints. Note that disabling REST API may break Elementor frontend editing and Gutenberg functionality. The most reliable mitigation is prompt patching to 4.0.5+. Verify patch installation by checking plugin version in WordPress admin dashboard and inspecting elementor-post-meta.php for the presence of sanitize_callback parameter.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today