CVE-2020-13864: Elementor Page Builder

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.

Affected products

• Elementor Elementor Page Builder: before 2.9.9 (fixed in 2.9.9)

Published 2020-06-05. Last modified 2026-06-17.