---
id: "CVE-2026-114183"
kind: "vulnerability"
aliases: ["CVE-2026-114183"]
title: "WordPress AnyWhere Elementor plugin leaks embedded sensitive data in responses"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "wordpress", "wpvibes"]
not_affected_if: []
published_at: "2026-11-03T17:17:54+00:00"
first_seen_at: "2026-11-03T17:21:54+00:00"
updated_at: "2026-11-03T17:24:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114183", "first_seen_at": "2026-11-03T17:21:54+00:00"}]
---

# WordPress AnyWhere Elementor plugin leaks embedded sensitive data in responses

The WPVibes AnyWhere Elementor WordPress plugin sends sensitive information inside data it returns to users. An attacker can retrieve that embedded sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `anywhere-elementor` plugin is installed on the WordPress site and note its version.
- Compare the installed version against the affected range in the NVD entry (through `1.3.0`).

## Timeline

- 2026-11-03T17:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114183

## From the sources

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_