CVE-2026-11767

HIGH

CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

Title source: cna

Description

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/e06a6497-e44f-43b9-b6ba-407aea171387/

Scores

CVSS v3 8.8

EPSS 0.0028

EPSS Percentile 19.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-79

Status published

Products (1)

None/Free Theme Builder for Elementor < 1.6.7

Published Jul 21, 2026

Tracked Since Jul 21, 2026