CVE-2026-117521 · Package
NO FIX YET · SEE WHAT TO DO
The Dynific Addons for Elementor WordPress plugin does not escape a user profile value in an Elementor widget attribute. An author can store a script in a post that runs in the browser of anyone who views it, including administrators.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Dynific Addons for Elementor plugin before 1.3.1 with Elementor widgets in use. The attacker needs an Author-role account, and the script runs when a logged-in user, including an administrator, views the attacker's post. Sites without the plugin, or with it at 1.3.1 or later, are not affected.
Not affected if no-author-accounts, plugin-at-1.3.1-or-later, plugin-not-installed
Who cares elementor, self-hosted, wordpress
Dynific Addons for Elementor (formerly Anywhere Elementor) plugin is installed and its version in the WordPress plugins screenDynific Addons for Elementor plugin to 1.3.1 or laterThe Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.