Elementor < 3.4.8 - DOM Cross-Site-Scripting
23Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 25%
exploitation probability
25%top 2% of all CVEs
observed exploitation
nono source reports it
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
Affected products
Unknown · Elementor Website Builder