CVE-2020-20406

5.4 mediumEPSS 0.7%

Medium (5.4) in elementor elementor page builder. EPSS 0.7% chance of exploitation in the next 30 days.

A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2020-09-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

elementor:elementor_page_builder

References

https://wordpress.org/plugins/elementor/#developers
https://wordpress.org/plugins/elementor/#developers

Check your stack JSON