An improper neutralization of user input during page rendering allows the Elementor plugin to execute arbitrary JavaScript. This vulnerability, classified as CWE-79, permits attackers to inject code that runs in the victim’s browser, potentially leading to credential theft, defacement or malicious redirection.

All installations of the Elementor Website Builder plugin for WordPress that are version 4.3.5 or earlier are vulnerable. The flaw is present in every release from the initial release up to and including 4.3.5. Upgrading to 4.3.6 or newer removes the issue.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by crafting a page or post that includes malicious script, assuming access to the Elementor editor. The flaw could be used by anyone with editing privileges on the site, making it a significant risk to sites with shared or less secure administrative access.