Medium severity · published Jun 5, 2020
CVE-2020-13865
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Elementor Page Builder · Elementor
before 2.9.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13865
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13865
Exploit
https://www.softwaresecured.com/elementor-page-builder-stored-xss/
More from Elementor Page Builder
9.9
CVE-2020-13126
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125
9.9
CVE-2020-7055
An issue was discovered in Elementor 2.7.4
8.8
CVE-2017-18596
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions
6.1
CVE-2018-18379
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS
5.4
CVE-2025-3076
Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting