PT-2026-61833 · Undefined · Undefined

Hitarth Shah · CVE-2026-11767 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-11767

Produtos afetados

Undefined

Referências · 2

• 🔥 https://wpscan.com/vulnerability/e06a6497-e44f-43b9-b6ba-407aea171387 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11767 · Nota de Segurança