Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-94573 · Microsoft / collected KEV context

cve-program · CVE-2026-94573

• https://www.wordfence.com/threat-intel/vulnerabilities/id/ea28fc6c-50d6-406b-9205-3f1bec577644?source=cve
• https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/libs/admin.js#L15
• https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/fields/repeater_end.php#L317
• https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/fields/repeater_end.php#L309
• https://plugins.trac.wordpress.org/browser/repeater-for-elementor/tags/2.2.7/fields/repeater_end.php#L237
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3710785%40repeater-for-elementor&new=3710785%40repeater-for-elementor

No related operational record is retained in the current change model.