Read the docs
TI-2021-06496 Aliases CVE-2021-24204GHSA-8236-9746-wqvp

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.

Why it matters now

EPSS 0.00746 55th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Elementor Website Builder (Unknown): 3.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownElementor Website Builder3.1.4 to before 3.1.43.1.4Patch availableCNA
  • Elementor Website Builder VendorUnknown Affected 3.1.4 to before 3.1.4 Fixed in 3.1.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*before 3.1.4VulnerableElementor
  • cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:* Versions before 3.1.4 Vulnerable ·Elementor

Remediation

  • Fix · CNA Elementor Website Builder (Unknown) Fixed in 3.1.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Elementor Website Builder 3.1.4

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2021-06498 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetPriority LOW 26
    • TI-2021-06497 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetPriority LOW 26
    • TI-2021-06495 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetPriority LOW 26
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24204
  2. 2026-10-03 Alias added: GHSA-8236-9746-wqvp

References

Exploit 2

  • TI-2022-01211 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution CVSS 3.1HIGH 8.8
  • TI-2023-00313 Elementor Website Builder < 3.12.2 - Admin+ SQLi CVSS 3.1HIGH 7.2
  • TI-2023-25675 WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-26607 WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2023-25676 WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
  • TI-2021-07171 Elementor < 3.4.8 - DOM Cross-Site-Scripting CVSS 3.1MEDIUM 6.1
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences