CVE-2026-11767

Name of the Vulnerable Software and Affected Versions Free Builder for Elementor versions prior to 1.6.7

Description An issue exists where submitted contact form field values are not sanitized before being stored and displayed in the admin dashboard. This allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, which then execute in the browser of a logged-in administrator viewing the form submissions.

Recommendations Update Free Builder for Elementor to version 1.6.7 or later.