{"id":"CVE-2026-114183","kind":"vulnerability","aliases":["CVE-2026-114183"],"related":[],"title":"WordPress AnyWhere Elementor plugin leaks embedded sensitive data in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","summary":"The WPVibes AnyWhere Elementor WordPress plugin sends sensitive information inside data it returns to users. An attacker can retrieve that embedded sensitive data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","wordpress","wpvibes"],"not_affected_if":[],"how_to_check":"- Check whether the `anywhere-elementor` plugin is installed on the WordPress site and note its version.\n- Compare the installed version against the affected range in the NVD entry (through `1.3.0`).","fix":null,"status":"open","published_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:19+00:00","updated_at":"2026-11-03T17:24:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress AnyWhere Elementor plugin leaks embedded sensitive data in responses","impact":"medium","summary":"The WPVibes AnyWhere Elementor WordPress plugin sends sensitive information inside data it returns to users. An attacker can retrieve that embedded sensitive data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpvibes","elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive embedded data is readable by anyone who requests it.","analyst_note":"Check the NVD entry and the WPVibes plugin changelog to confirm the affected versions, the leaked data type, and whether a fixed version exists.","how_to_check":"- Check whether the `anywhere-elementor` plugin is installed on the WordPress site and note its version.\n- Compare the installed version against the affected range in the NVD entry (through `1.3.0`).","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the AnyWhere Elementor plugin from WPVibes at version 1.3.0 or earlier, as listed in NVD. The sources do not say which configurations or pages expose the data, so the exact exposure path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000667,"input_tokens":4132,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114183':13A,16A '-2026':12A,15A '1.3.0':71C 'affect':65C 'allow':59C 'anywher':2A,23B,54C,57C,66C 'anywhere-elementor':56C 'attack':37B 'cve':11A,14A 'data':8A,31B,43B,50C 'data.this':63C 'elementor':3A,17B,24B,55C,58C,67C 'embed':6A,41B,61C 'inform':29B,47C 'insert':44C 'insid':30B 'issu':64C 'leak':5A 'n/a':69C 'packag':18B 'plugin':4A,26B 'respons':10A 'retriev':39B,60C 'return':33B 'send':27B 'sensit':7A,28B,42B,46C,62C 'sent':49C 'user':35B 'vulner':51C 'wordpress':1A,19B,25B 'wpvibe':20B,22B,53C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AnyWhere Elementor plugin from WPVibes at version 1.3.0 or earlier, as listed in NVD. The sources do not say which configurations or pages expose the data, so the exact exposure path is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","wordpress","wpvibes"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114183","severity":null,"published_at":"2026-11-03T17:17:54+00:00","modified_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}