CVE-2026-11767

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.51% chance of exploitation in the next 30 days, 41th percentile

Published

2026-07-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e06a6497-e44f-43b9-b6ba-407aea171387/

References

• CVE Record
• NVD entry

Related

• CVE-2026-11766
• CVE-2026-1177
• CVE-2026-1176
• CVE-2026-11779
• CVE-2026-1175
• CVE-2026-1178