{"title":"WordPress Elementor plugin <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path vulnerability","description":"Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path vulnerability discovered by Asaf Mozes in WordPress Plugin Elementor Website Builder (versions <= 3.33.3)","affected_in":"<= 3.33.3","fixed_in":"3.33.4","references":[{"slug":"patchstack","label":"PatchStack","refs":[{"value":"wordpress-elementor-plugin-3-33-3-authenticated-contributor-stored-dom-based-cross-site-scripting-via-text-path-vulnerability","label":"Details","link":"https:\/\/patchstack.com\/database\/vulnerability\/elementor\/wordpress-elementor-plugin-3-33-3-authenticated-contributor-stored-dom-based-cross-site-scripting-via-text-path-vulnerability?_a_id=431"}]},{"slug":"cve","label":"CVE","refs":[{"value":"2025-11220","label":"2025-11220","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-11220"}]}],"type":{"label":"Cross Site Scripting (XSS)","slug":""},"id":"ps-36108","created_at":"2025-12-16T00:53:03+00:00","updated_at":"2025-12-16T00:53:03+00:00","published_at":"2025-12-16T00:53:00+00:00","score":6.5,"score_group":"","score_vector":"","is_exploited":false,"patched_in_ranges":[],"patch_priority":1}