CVE-2022-4953

Elementor < 3.5.5 - Iframe Injection

6.1 MediumPublic exploit

CVE-2022-4953 is a medium vulnerability (CVSS 6.1) in Elementor Website Builder, published August 14, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.41%, the 88th percentile. No source names a fixed version.

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

3.41%Up 3.4 points since Aug 15, 2023

What each source reports

NVD Score used 6.1

Record: CVE-2022-4953
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

CVE List No score

Elementor < 3.5.5 - Iframe Injection

Record: CVE-2022-4953
Updated: 2026-11-02

EUVDEUVD-2022-52206 No score

Record: EUVD-2022-52206
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3gvr-rm94-r528 6.1

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled...

Record: GHSA-3gvr-rm94-r528
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-80
Updated: 2026-11-02

OSV No score

Elementor < 3.5.5 - Iframe Injection

Record: CVE-2022-4953
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Wordpress Plugin Elementor 3.5.5 - Iframe Injection	2023-09-08

History

History
When	Changed	Sources
2026-11-03	aliases, products, published	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV