MEDIUMCVSS v3.1 6.8Vulnerability
CVE-2026-104718
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Epss score
- 0.002
- Cvss severity
- MEDIUM
- Cvss score
- 6.8
- Retrieved at
- 2026-11-11T23:51:12+00:00
- Last source
- FIRST EPSS
- Score
- 6.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-104718
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-11T07:36:44+00:00
- Name
- CVE-2026-104718
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-11-11T06:17:10.440
- Last modified
- 2026-11-11T12:18:15.080
- Epss percentile
- 0.09919
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph