Hitarth Shah

**Name of the Vulnerable Software and Affected Versions** Free Builder for Elementor versions prior to 1.6.7 **Description** An issue exists where submitted contact form field values are not sanitized before being stored and displayed in the admin dashboard. This allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, which then execute in the browser of a logged-in administrator viewing the form submissions. **Recommendations** Update Free Builder for Elementor to version 1.6.7 or later.