What is GHSA-9g9m-xxjx-jx22?

GHSA-9g9m-xxjx-jx22 is a security advisory published by GitHub Security Advisories with High severity. The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted...

Which CVE IDs does GHSA-9g9m-xxjx-jx22 cover?

GHSA-9g9m-xxjx-jx22 covers the following CVE IDs: CVE-2026-11767. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9g9m-xxjx-jx22?

GHSA-9g9m-xxjx-jx22 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-9g9m-xxjx-jx22HighCVSS 8.8

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted...

Vendor

GitHub Security Advisories

Published

July 21, 2026

Last Modified

July 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-11767 →

📋 Description

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-11767
https://wpscan.com/vulnerability/e06a6497-e44f-43b9-b6ba-407aea171387
https://github.com/advisories/GHSA-9g9m-xxjx-jx22