Live › vulnerability › CVE-2026-114184
Go to dashboardThe Elementor Addon Elements plugin by WPVibes does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content stored by the plugin can run JavaScript in the browser of other users who view that page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Elementor Addon Elements plugin at version 1.14.4 or earlier with Elementor pages in use. The sources do not say which user roles can submit the stored content, so the required privilege level is unknown. Sites without this plugin installed are not affected.
No product ranges from the sources yet.
1.14.4 are affected.1.14.4, once the vendor publishes one (unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-114184")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.