The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13864
Reference (s):
- https://www.softwaresecured.com/elementor-page-builder-stored-xss/