Security Alert Summary
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitize submitted contact form field values before storing and displaying them in the admin dashboard. An unauthenticated attacker can submit malicious payloads that result in Stored Cross-Site Scripting (XSS) when a logged-in administrator views the form submissions.
CVE Details
- CVE ID: CVE-2026-11767
- Affected component: Free Builder for Elementor WordPress plugin (contact form submission handling)
- Affected versions: Versions less than 1.6.7
- Published: July 21, 2026 at 07:16:33 AM UTC
- Last modified: July 21, 2026 at 04:17:04 PM UTC
- CVSS v3.1: Base score 8.8, severity HIGH, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: No privileges required (PR:N); attacker unauthenticated. User interaction is required (UI:R) as the issue executes when an administrator views submissions.
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Stored Cross-Site Scripting)
Technical Details
The plugin fails to sanitize or neutralize contact form field values before storing them and rendering them in the WordPress admin dashboard. Because submitted values are stored and later output without proper sanitization, an attacker can include a crafted payload in a form submission that will be stored on the site. When a logged-in administrator views the stored submission in the dashboard, the payload can execute as script in the administrator’s browser context (Stored XSS).
The available information does not name specific plugin functions or REST endpoints. The essential cause is the absence of input sanitization and safe output encoding for stored form data that is later displayed in the admin UI. The CVSS vector indicates the attack is network-accessible, requires no attacker privileges, and relies on an administrator viewing the stored data to trigger execution.
How This Could Impact Your Website
Consider a site with a site owner, internal staff who manage content, and an external contractor who provides support. An unauthenticated attacker could submit a malicious form entry that appears in the admin dashboard. When an administrator or editor views the submission, the injected script could run in their browser. Practical consequences include exposure of data visible in the admin UI, such as stored form contents and potentially internal user email addresses, and an increased risk of targeted phishing or social engineering against staff whose contact details are exposed.
This issue does not itself claim remote code execution on the server, but scripts running in an administrator’s browser can perform actions available to that user or steal data visible in the browser. If you\u2019re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for contributor and editor accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and admin dashboard views for unusual behavior or unexpected entries in form submissions.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
