Live › vulnerability › CVE-2026-116848
The Plus Addons for Elementor Page Builder Lite, a WordPress plugin, has a stored cross-site scripting flaw in versions through 6.5.3. An attacker who can submit input that gets saved and later rendered can run scripts in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running The Plus Addons for Elementor Page Builder Lite at version 6.5.3 or earlier are in the affected range per NVD. Exposure depends on whether users without full trust can submit content that is stored and rendered; the sources do not say which configurations are affected.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-116848")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.