Elementor has fixed the security vulnerability CVE-2026-104718 in version 4.3.6. It can be exploited by a logged-in account with the Contributor role or higher: it injects a script into a page that then runs in the browser of every viewer, including the browser of an administrator who is reviewing a draft.
The security provider WPScan published the vulnerability on November 9, 2026 and rated it as medium severity at 6.8 out of 10. WPScan plans to release the example code for the attack on November 23, so that site operators can update beforehand.
What is behind the vulnerability?
Elementor did not validate the ID of a page element before the plugin wrote it into an attribute that a framework in the browser evaluates as JavaScript. Technically, this is persistent cross-site scripting: the malicious code is embedded in the page itself and runs again on every request.
The WPScan report names Hung Bach Ngoc as the discoverer and lists all Elementor versions before 4.3.6 as affected. The title says "Contributor+", whereas the CVSS vector with the detailed score assumes high privileges. WPScan does not state clearly which role is sufficient, so it is better to assume the lower hurdle.
Who is affected by the vulnerability?
Affected are sites on which outside people hold an account with the Contributor role or higher: magazines with guest authors, sites with open registration, and client sites on which clients submit content. For a site that only you use as administrator, the risk is lower. However, a hijacked account is enough as an entry point.
The current version is 4.4.0 from November 9, 2026 and contains the fix. According to WordPress.org, it requires WordPress 6.8 and PHP 7.4, and the plugin has more than 10 million active installations. If WordPress does not offer you an update, first check your WordPress and PHP versions.
What this means for you
In the WordPress menu, open the plugin list and read the version number in the Elementor row. If the version is below 4.3.6, it is best to install the update this week, at the latest before November 23. Create a backup beforehand so that you can return to the previous state if problems occur.
How to secure Elementor
For Elementor before version 4.3.6, as of November 13, 2026
- Check the versionunder Plugins in the Elementor row
- Create a backupBack up the site before the update
- Updateto 4.3.6 or newer, currently 4.4.0
- Review accountsContributor role and higher under Users
WPScan plans to publish the example code for the attack on November 23.
Sources: WPScan, WordPress.org
Afterwards, look at all accounts with the Contributor role or higher under Users and delete those that nobody needs anymore. For the remaining accounts, a new password is advisable if you no longer fully trust them.
Also turn on automatic updates for Elementor: in the plugin list, the Elementor row has the option "Enable auto-updates". The next fix will then land on your site without delay. For client sites, you agree on this with the client beforehand.
At 6.8, the vulnerability counts as medium severity, not critical. But because Elementor has more than 10 million active installations and the example code is due to appear from November 23, updating before that date is worthwhile.
WPScan published the report on November 9, 2026.
Sources
