CVE-2022-29455 MEDIUM

CVE-2022-29455: WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

Vendor Elementor
Product Elementor Website Builder (WordPress plugin)
Weakness CWE-79 · XSS
Published June 13, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.

Key dates

02Disclosure timeline

June 13, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-32961 WordPress Zotpress Plugin <= 7.3.3 is vulnerable to Cross Site Scripting (XSS) CVE-2024-30519 WordPress Lordicon Animated Icons plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-0599 Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x CVE-2024-27965 WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2024-8990 Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode