Free Theme Builder for Elementor: Cross-site scripting
Free Theme Builder for Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 1.6.7.
- Component
- Free Theme Builder for Elementor
- Plugin slug
free-builder-for-elementor- Affected
- < 1.6.7
- Safe version
1.6.7- Published
- Jul 21, 2026
This CVE was published Jul 21, 2026 and is one of 1 known issue for this plugin.
Patch or disable the affected component.
Update Free Theme Builder for Elementor to 1.6.7 or later, or disable and remove it until a fixed version is available.
Technical description
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H