CVE-2026-104718
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.