CVE-2026-11767 — CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboa…
Published: 2026-07-21 · CVSS: 8.8 · CVSS 3.1
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7