Elementor XSS Vulnerability: Update to 4.3.6 Now

Elementor is installed on millions of WordPress sites worldwide, and if yours is running a version below 4.3.6, an attacker can exploit a known vulnerability to inject malicious scripts into your site. Those scripts run in the browsers of anyone who visits the affected pages, including your customers and staff. The consequence is concrete: session cookies stolen, credentials harvested, users redirected to fraudulent pages, your site turned into the delivery mechanism for an attack on the people who trust it.

The vulnerability carries a CVSS score of 7.1, placing it in the high severity band. The flaw is a Cross-Site Scripting (XSS) issue, meaning an attacker can inject client-side scripts through inputs that Elementor processes without properly sanitising the output. XSS vulnerabilities are particularly damaging on business sites because the attack executes silently inside a legitimate browser session: a visitor sees your site, trusts your site, and has no reason to suspect anything is wrong while their data is being exfiltrated. Every version of Elementor Website Builder below 4.3.6 is affected.

Check Your Version Before Reading Any Further

Log into your WordPress dashboard and go to Plugins, then Installed Plugins. Find Elementor Website Builder in the list. The version number appears directly below the plugin name — if it reads anything lower than 4.3.6, your site is exposed right now.

If you manage multiple WordPress installations, check each one separately, because a plugin updated on one site has no effect on another. There is no central update mechanism across separate WordPress installs unless you are using a management platform such as MainWP or ManageWP, in which case you can audit version status across your entire portfolio from a single dashboard.

Whilst you are in the plugins screen, also check whether automatic updates are enabled for Elementor. In the plugin list, look for the “Enable auto-updates” link to the right of the plugin entry. For a plugin this widely used and this frequently targeted, automatic updates are worth switching on. You will still want to test updates on a staging environment before they reach your live site, but that is a process question rather than a reason to stay on a vulnerable version.

Update to Elementor 4.3.6 and Test Immediately After

Go to Dashboard, then Updates, and if Elementor appears in the list, run the update now. WordPress will download and install the patched version automatically, and the process takes under a minute on most hosting environments.

After updating, walk through the pages built with Elementor and confirm they render correctly. Elementor updates occasionally affect widget behaviour or layout rendering, so a quick visual check of your key pages takes two minutes and avoids any unpleasant surprises. If you maintain a staging environment, apply the update there first, confirm nothing breaks, then push to production. If your site is managed by a hosting provider that restricts direct plugin updates, contact them today and ask them to apply this update, referencing the CVE number directly: CVE-2026-109884.

XSS vulnerabilities can be exploited before any public proof-of-concept code circulates widely. The CVE record is public, which means the window between disclosure and active exploitation is short, and waiting until your next scheduled maintenance window leaves your site exposed through that entire interval.

Keeping plugins updated is the single most effective control available to a WordPress site owner against the most common class of attacks. The WordPress plugin ecosystem moves fast: vulnerabilities are discovered regularly, patches are issued quickly, and the gap between a patch being released and attackers scanning for unpatched sites is measured in hours. A site running outdated plugins carries a known, documented weakness that automated scanners will find.

The business case is straightforward. Recovery from a compromised site involves forensic investigation to establish what was accessed, cleaning injected code from the database and file system, notifying affected users if personal data was exposed, and the reputational damage of a site that Google may have already flagged as dangerous. The update takes less than a minute. The recovery takes days, and the reputational cost does not appear on an invoice.

There is also a point that business owners often miss. Plugin updates frequently contain performance improvements and compatibility fixes for the current version of WordPress core, so running outdated plugins on a current WordPress install can cause conflicts that degrade site performance or break functionality in ways that are difficult to diagnose without knowing the version history of every plugin involved.

If you are not confident in your ability to apply updates safely, test them, or monitor for new vulnerabilities across your plugin stack, that gap is worth closing with professional support rather than leaving open.

---

If your site is running Elementor below version 4.3.6, contact me at The WordPress Guy today and I will apply the patch, run a post-update visual check across your Elementor pages, and confirm your site is clean. The CVE-2026-109884 vulnerability is publicly disclosed, which means the window before active exploitation narrows by the day. A single unpatched site is all an attacker needs.