{"id":"CVE-2026-116848","kind":"vulnerability","aliases":["CVE-2026-116848"],"related":[],"title":"The Plus Addons for Elementor: stored XSS lets page input run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.","summary":"The Plus Addons for Elementor Page Builder Lite, a WordPress plugin, has a stored cross-site scripting flaw in versions through 6.5.3. An attacker who can submit input that gets saved and later rendered can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","other","the-plus-addons","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of The Plus Addons for Elementor Page Builder Lite (the-plus-addons-for-elementor-page-builder) in the WordPress plugins screen; unknown whether the sources list a fixed version.","fix":null,"status":"open","published_at":"2026-10-29T16:18:00+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:31:22+00:00","updated_at":"2026-10-29T16:31:22+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T16:31:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"The Plus Addons for Elementor: stored XSS lets page input run scripts","impact":"medium","summary":"The Plus Addons for Elementor Page Builder Lite, a WordPress plugin, has a stored cross-site scripting flaw in versions through 6.5.3. An attacker who can submit input that gets saved and later rendered can run scripts in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","the-plus-addons"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, possibly stealing sessions.","analyst_note":"Check the vendor changelog or the NVD entry for the fixed version and the required privileges to store the payload.","how_to_check":"- Check the installed version of The Plus Addons for Elementor Page Builder Lite (the-plus-addons-for-elementor-page-builder) in the WordPress plugins screen; unknown whether the sources list a fixed version.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running The Plus Addons for Elementor Page Builder Lite at version 6.5.3 or earlier are in the affected range per NVD. Exposure depends on whether users without full trust can submit content that is stored and rendered; the sources do not say which configurations are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4166,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116848':15A,18A '-2026':14A,17A '6.5.3':48B,116C 'addon':3A,24B,28B,86C,95C,107C 'affect':104C 'allow':100C 'attack':50B 'browser':67B 'builder':32B,90C,99C,111C 'cross':41B,77C 'cross-sit':40B,76C 'cve':13A,16A 'elementor':5A,19B,30B,88C,97C,109C 'flaw':44B 'generat':75C 'get':56B 'improp':68C 'innov':83C 'input':10A,54B,71C 'issu':103C 'later':59B 'let':8A 'lite':33B,91C,112C 'n/a':114C 'neutral':69C 'page':9A,31B,74C,89C,98C,110C 'plugin':36B 'plus':2A,23B,27B,85C,94C,106C 'posimyth':82C 'render':60B 'run':11A,62B 'save':57B 'script':12A,43B,63B,79C 'site':42B,78C 'store':6A,39B,101C 'submit':53B 'the-plus-addon':21B 'the-plus-addons-for-elementor-page-build':92C 'version':46B 'visitor':66B 'vulner':80C 'web':73C 'wordpress':25B,35B 'xss':7A 'xss.this':102C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Plus Addons for Elementor Page Builder Lite at version 6.5.3 or earlier are in the affected range per NVD. Exposure depends on whether users without full trust can submit content that is stored and rendered; the sources do not say which configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116848","severity":null,"published_at":"2026-10-29T16:18:00+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}