The Elementor Website Builder plugin accepts form‑encoded PATCH requests to the WordPress REST API, processing the _elementor_data meta field without proper sanitization. Because the filter that sanitizes only JSON input is bypassed for form‑encoded bodies, malicious data is stored directly in the database. When pages that include the affected widgets are rendered, the unsanitized content is emitted without escaping, allowing an attacker with contributor‑level or higher access to inject executable scripts that run in the browsers of any visitor to the targeted page. This flaw enables the attacker to compromise the confidentiality, integrity, and availability of the website’s user sessions through malicious JavaScript.

The vulnerability affects any WordPress site that has the Elementor Website Builder plugin installed in version 4.0.4 or earlier. Users of the plugin’s page and widget features at Contributor, Editor or Administrator levels are potentially affected. Sites using higher‑version releases (4.0.5 and later) are not vulnerable.

The CVSS score of 6.4 indicates moderate severity, but the flaw is exploitable by users who already have contributor permissions—a role that many site collaborators hold. The EPSS score is <1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires authenticated access and relies on the REST API, it is not a low‑barrier exploit but can have significant impact if an attacker gains contributor access. The safest approach is to assume the risk is real because the defacement payloads can persist in page content and affect all users.