CVE-2022-4953
MEDIUMElementor Website Builder <3.5.5 - XSS
Title source: llmDescription
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Exploits (1)
exploitdb
WORKING POC
by Miguel Santareno · textwebappsphp
https://www.exploit-db.com/exploits/51716
Scores
CVSS v3
6.1
EPSS
0.1031
EPSS Percentile
93.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
Status
published
Products (1)
elementor/website_builder
< 3.5.5
Published
Aug 14, 2023
Tracked Since
Feb 18, 2026