{"id":"CVE-2026-114184","kind":"vulnerability","aliases":["CVE-2026-114184"],"related":[],"title":"Elementor Addon Elements WordPress plugin: stored XSS through version 1.14.4","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.","summary":"The Elementor Addon Elements plugin by WPVibes does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content stored by the plugin can run JavaScript in the browser of other users who view that page.","severity":"medium","cvss":6.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Elementor Addon Elements plugin (addon-elements-for-elementor-page-builder) in the WordPress admin plugins list; versions through `1.14.4` are affected.\n- Confirm whether the plugin is active on the site.","fix":"- Update addon-elements-for-elementor-page-builder to a version later than `1.14.4`, once the vendor publishes one (unknown from the sources).\n- Until a fixed version is available, deactivate the plugin or restrict contributor-level content submission.","status":"open","published_at":"2026-10-22T07:16:42+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:47:30+00:00","updated_at":"2026-10-25T03:47:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update addon-elements-for-elementor-page-builder to a version later than `1.14.4`, once the vendor publishes one (unknown from the sources).\n- Until a fixed version is available, deactivate the plugin or restrict contributor-level content submission.","reach":"internet","title":"Elementor Addon Elements WordPress plugin: stored XSS through version 1.14.4","impact":"medium","summary":"The Elementor Addon Elements plugin by WPVibes does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content stored by the plugin can run JavaScript in the browser of other users who view that page.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Confirm the affected input field, the minimum privilege needed to store the payload, and the fixed plugin version from the NVD entry or WPVibes changelog.","how_to_check":"- Check the installed version of the Elementor Addon Elements plugin (addon-elements-for-elementor-page-builder) in the WordPress admin plugins list; versions through `1.14.4` are affected.\n- Confirm whether the plugin is active on the site.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Elementor Addon Elements plugin at version 1.14.4 or earlier with Elementor pages in use. The sources do not say which user roles can submit the stored content, so the required privilege level is unknown. Sites without this plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3368,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114184':13A,16A '-2026':12A,15A '1.14.4':10A,103C 'addon':2A,25B,83C,86C,98C 'addon-elements-for-elementor-page-build':85C 'affect':96C 'allow':92C 'attack':45B 'browser':59B 'builder':91C 'content':49B 'cross':41B,76C 'cross-sit':40B,75C 'cve':11A,14A 'element':3A,26B,84C,87C,99C 'elementor':1A,17B,24B,82C,89C,97C 'enabl':38B 'generat':35B,74C 'host':21B 'improp':67C 'input':33B,70C 'issu':95C 'javascript':56B 'n/a':101C 'neutral':32B,68C 'packag':18B 'page':37B,66B,73C,90C 'plugin':5A,27B,53B 'run':55B 'script':43B,78C 'self':20B 'self-host':19B 'site':42B,77C 'store':6A,39B,50B,93C 'submit':48B 'user':62B 'version':9A 'view':64B 'vulner':79C 'web':36B,72C 'wordpress':4A,22B 'wpvibe':29B,81C 'xss':7A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Elementor Addon Elements plugin at version 1.14.4 or earlier with Elementor pages in use. The sources do not say which user roles can submit the stored content, so the required privilege level is unknown. Sites without this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114184","severity":null,"published_at":"2026-10-22T07:16:42+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114184","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114184","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}