CVE-2021-24891: Elementor < 3.4.8 - DOM Cross-Site-Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 27.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-23 · updated 2026-06-17
Weakness: CWE-79

Description

The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.

Affected products

Elementor Website Builder: from 1.5.0 (excl.) before 3.1.4; from 3.2.0 before 3.4.8 — fixed in 3.1.4, 3.4.8

How to fix

Upgrade to a fixed version: Elementor Website Builder 3.1.4, 3.4.8. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d
https://www.jbelamor.com/xss-elementor-lightox.html
https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d
https://www.jbelamor.com/xss-elementor-lightox.html

Get alerted when CVE-2021-24891 or the next vulnerability affects your stack