CVE-2026-104718: falha de média gravidade em Elementor Website Builder
Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Elementor Website BuilderCVEs relacionadas — Elementor Website Builder
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 28.9%CVE-2023-0329HIGHElementor Website Builder < 3.12.2 - Admin+ SQLiEPSS 19.7%CVE-2022-4953—Elementor < 3.5.5 - Iframe InjectionEPSS 3.4%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%