CVE-2026-11767

HighCVSS 8.8/10Last modified Jul 21, 2026

Description

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownFree Theme Builder for Elementor< 1.6.7

References

Timeline

Published
Jul 21, 2026
Last modified
Jul 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1176776.5When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limitingCVE-2026-1176795.1A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's CVE-2026-1176802.1Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthCVE-2026-1176818.0A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables TransporCVE-2026-1176859.1The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the souCVE-2026-1176876.9Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a speciaCVE-2026-1176885.3A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provCVE-2026-117698.8We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege eCVE-2026-1176919.1A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encodedCVE-2026-11779.8A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jCVE-2026-117707.5A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replicationCVE-2026-117717.5OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authenti
CVE-2026-11767: High severity, CVSS 8.8 | Vulnix