Medium severity · published Sep 16, 2020
CVE-2020-20406
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Elementor Page Builder · Elementor
through 2.9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-20406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-20406
Product
https://wordpress.org/plugins/elementor/#developers
More from Elementor Page Builder
9.9
CVE-2020-13126
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125
9.9
CVE-2020-7055
An issue was discovered in Elementor 2.7.4
8.8
CVE-2017-18596
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions
6.1
CVE-2018-18379
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS
5.4
CVE-2025-3076
Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting