{
 "id": "WPSEC-2026-2416",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2416/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2416/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2416/index.md",
 "title": "Elementor <= 4.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Atomic Element ID",
 "description": "The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Atomic element IDs in versions 4.1.0 up to, and including, 4.3.5 due to element IDs being concatenated into Alpine.js expressions in atomic widget templates without restricting them to safe identifier characters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary JavaScript that will execute whenever a user accesses an affected page. Exploitation requires the Atomic Widgets feature to be active, which is the default on sites first installed at version 4.0.0 or later.",
 "plugin": {
  "slug": "elementor",
  "name": "Elementor",
  "full_name": "Elementor Website Builder – more than just a page builder",
  "wordpress_org": "https://wordpress.org/plugins/elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.1.0",
    "from_inclusive": true,
    "to": "4.3.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.1.0 before 4.3.6"
  ]
 },
 "introduced_in": "4.1.0",
 "fixed_in": "4.3.6",
 "remediation": "Update to 4.3.6 or later.",
 "fix_released": "2026-11-02T17:39:55+00:00",
 "published": "2026-11-03T17:48:37+00:00",
 "updated": "2026-11-03T13:38:07.821382+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2416/",
  "https://plugins.svn.wordpress.org/elementor/tags/4.3.6/",
  "https://wordpress.org/plugins/elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}