The Elementor Website Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the url parameter in multiple widgets. This occurs because the plugin does not adequately sanitize or escape user input before rendering it in web pages. Authenticated users with contributor-level permissions or higher can exploit this vulnerability to inject malicious scripts into pages edited with Elementor. Although a partial patch was applied in version 3.23.2, versions up to 3.23.4 remain vulnerable. The CVSS 3.1 base score is 5.4, reflecting medium severity with network attack vector, low attack complexity, and requiring privileges with user interaction.

Successful exploitation allows authenticated users with contributor-level access or above to inject and execute arbitrary JavaScript in the context of the Elementor Editor pages. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information or manipulation of page content within the editor environment. There is no indication of availability impact. The vulnerability does not appear to be exploited in the wild based on current data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial fix was introduced in version 3.23.2, but versions up to 3.23.4 remain vulnerable. Users should monitor official Elementor communications for a full patch or update beyond 3.23.4. Until a confirmed fix is available, restrict contributor-level access to trusted users only and consider additional input validation or content security policies to mitigate risk.