{"id":"CVE-2026-114185","kind":"vulnerability","aliases":["CVE-2026-114185"],"related":[],"title":"WordPress AnyWhere Elementor plugin: stored XSS through version 1.3.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","summary":"The AnyWhere Elementor WordPress plugin by WPVibes fails to neutralize input, which allows stored cross-site scripting. An attacker who can get script stored in the site can run it in the browser of later visitors, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `anywhere-elementor` plugin is installed and its version in the WordPress admin under Plugins.","fix":"- Versions above `1.3.0` are reported by the source as not affected; the fixed version is unknown beyond that.","status":"open","published_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:17+00:00","updated_at":"2026-11-03T17:24:17+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-03T17:24:17Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `1.3.0` are reported by the source as not affected; the fixed version is unknown beyond that.","reach":"internet","title":"WordPress AnyWhere Elementor plugin: stored XSS through version 1.3.0","impact":"medium","summary":"The AnyWhere Elementor WordPress plugin by WPVibes fails to neutralize input, which allows stored cross-site scripting. An attacker who can get script stored in the site can run it in the browser of later visitors, including administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers, possibly stealing admin sessions","analyst_note":"Check the WPVibes plugin page or the WordPress.org plugin changelog for a fixed version and the required privilege level; source is NVD only.","how_to_check":"- Check whether the `anywhere-elementor` plugin is installed and its version in the WordPress admin under Plugins.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AnyWhere Elementor plugin at version 1.3.0 or earlier are affected according to the NVD description. Whether an attacker needs an account to store the script is unknown. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4128,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114185':12A,15A '-2026':11A,14A '1.3.0':9A,91C 'administr':60B 'affect':85C 'allow':34B,81C 'anywher':2A,23B,76C,79C,86C 'anywhere-elementor':78C 'attack':41B 'browser':55B 'cross':37B,70C 'cross-sit':36B,69C 'cve':10A,13A 'elementor':3A,16B,24B,77C,80C,87C 'fail':29B 'generat':68C 'get':44B 'host':20B 'improp':61C 'includ':59B 'input':32B,64C 'issu':84C 'later':57B 'n/a':89C 'neutral':31B,62C 'page':67C 'plugin':4A,26B 'run':51B 'script':39B,45B,72C 'self':19B 'self-host':18B 'site':38B,49B,71C 'store':5A,35B,46B,82C 'version':8A 'visitor':58B 'vulner':73C 'web':66C 'wordpress':1A,21B,25B 'wpvibe':28B,75C 'xss':6A 'xss.this':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AnyWhere Elementor plugin at version 1.3.0 or earlier are affected according to the NVD description. Whether an attacker needs an account to store the script is unknown. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","other","selfhosted","wordpress"],"first_public_at":"2026-11-03T17:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114185","severity":null,"published_at":"2026-11-03T17:17:54+00:00","modified_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}