CVE-2026-109884: fallo de gravedad alta en Elementor Website Builder
WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
40Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck.
ssvc Actcvss 7.1
de la publicación al arma
Publicada en NVD6 nov
VulnCheck6 nov
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Productos afectados
Elementor · Elementor Website BuilderCVEs relacionadas — Elementor Website Builder
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-47504MEDIUMWordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerabilityEPSS 1.5%CVE-2024-24934HIGHWordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerabilityEPSS 0.7%CVE-2026-57619MEDIUMWordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2023-33922MEDIUMWordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-37437MEDIUMWordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerabilityEPSS 0.3%CVE-2024-54444MEDIUMWordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%