CVE-2022-4953

MEDIUM

Elementor Website Builder <3.5.5 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-4953. PoCs published by Miguel Santareno.

AI-analyzed exploit summary This exploit demonstrates an iframe injection vulnerability in WordPress Plugin Elementor versions prior to 3.5.5. The PoC URL manipulates the `elementor-action` parameter to inject a malicious iframe via the `lightbox` feature.

Description

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

Exploits (1)

exploitdb WORKING POC
by Miguel Santareno · textwebappsphp
https://www.exploit-db.com/exploits/51716

This exploit demonstrates an iframe injection vulnerability in WordPress Plugin Elementor versions prior to 3.5.5. The PoC URL manipulates the `elementor-action` parameter to inject a malicious iframe via the `lightbox` feature.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin Elementor < 3.5.5
No auth needed
Prerequisites: A vulnerable WordPress site with Elementor plugin < 3.5.5 installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.1154
EPSS Percentile 93.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

Status published
Products (1)
elementor/website_builder < 3.5.5
Published Aug 14, 2023
Tracked Since Feb 18, 2026