blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-11767

HIGH 8.8 CVSS 3.1
Published
July 21, 2026
Last modified
July 21, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

Affected products and versions

  • Unknown Free Theme Builder for Elementor — Before 1.6.7

References

  • wpscan.com https://wpscan.com/vulnerability/e06a6497-e44f-43b9-b6ba-407aea171387/
  • nvd.nist.gov Official NVD record