{"id":"CVE-2026-115950","kind":"vulnerability","aliases":["CVE-2026-115950"],"related":[],"title":"WordPress Elementor widget plugin: stored XSS through versions 1.9.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.","summary":"Better Post & Filter Widgets for Elementor, a WordPress plugin, does not neutralize input when it generates web pages, so stored cross-site scripting is possible. An attacker who can get script saved into the plugin's content can run JavaScript in the browser of any visitor or admin who views that content.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get better-post-filter-widgets-for-elementor --field=version`\n- Look for the plugin slug `better-post-filter-widgets-for-elementor` in the plugins directory","fix":"- Update Better Post & Filter Widgets for Elementor to a version later than `1.9.1`; the sources do not name the fixed version\n- If no fixed release exists, deactivate and remove the plugin","status":"open","published_at":"2026-10-26T11:16:35+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:08+00:00","updated_at":"2026-10-26T11:31:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update Better Post & Filter Widgets for Elementor to a version later than `1.9.1`; the sources do not name the fixed version\n- If no fixed release exists, deactivate and remove the plugin","reach":"internet","title":"WordPress Elementor widget plugin: stored XSS through versions 1.9.1","impact":"medium","summary":"Better Post & Filter Widgets for Elementor, a WordPress plugin, does not neutralize input when it generates web pages, so stored cross-site scripting is possible. An attacker who can get script saved into the plugin's content can run JavaScript in the browser of any visitor or admin who views that content.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed version and the minimum role needed to store the payload from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get better-post-filter-widgets-for-elementor --field=version`\n- Look for the plugin slug `better-post-filter-widgets-for-elementor` in the plugins directory","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Better Post & Filter Widgets for Elementor at version 1.9.1 or earlier, where Elementor pages render the plugin's widgets. Sites without this plugin installed can skip it. The sources do not say which user roles can store the malicious input.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3346,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115950':12A,15A '-2026':11A,14A '1.9.1':9A,119C 'admin':70B 'affect':109C 'allow':105C 'attack':49B 'better':22B,92C,99C,110C 'better-post-filter-widgets-for-elementor':98C 'browser':65B 'content':59B,74B 'cross':43B,84C 'cross-sit':42B,83C 'cve':10A,13A 'elementor':2A,16B,27B,97C,104C,115C 'filter':24B,94C,101C,112C 'generat':37B,82C 'get':52B 'host':20B 'improp':75C 'input':34B,78C 'issu':108C 'javascript':62B 'n/a':117C 'neutral':33B,76C 'packag':17B 'page':39B,81C 'plugin':4A,30B,57B 'possibl':47B 'post':23B,93C,100C,111C 'run':61B 'save':54B 'script':45B,53B,86C 'self':19B 'self-host':18B 'site':44B,85C 'smart':90C 'store':5A,41B,106C 'version':8A 'view':72B 'visitor':68B 'vulner':87C 'web':38B,80C 'widget':3A,25B,91C,95C,102C,113C 'wordpress':1A,21B,29B 'wp':89C 'xss':6A 'xss.this':107C","nicknames":[],"mitigations":[],"who_affected":"Sites running Better Post & Filter Widgets for Elementor at version 1.9.1 or earlier, where Elementor pages render the plugin's widgets. Sites without this plugin installed can skip it. The sources do not say which user roles can store the malicious input.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115950","severity":null,"published_at":"2026-10-26T11:16:35+00:00","modified_at":"2026-10-26T11:16:35+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}