{"id":"CVE-2026-117521","kind":"vulnerability","aliases":["CVE-2026-117521"],"related":[],"title":"WordPress Dynific Addons for Elementor: stored script runs in viewers' sessions","description":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting.","summary":"The Dynific Addons for Elementor WordPress plugin does not escape a user profile value in an Elementor widget attribute. An author can store a script in a post that runs in the browser of anyone who views it, including administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-author-accounts","plugin-at-1.3.1-or-later","plugin-not-installed"],"how_to_check":"- Check whether the `Dynific Addons for Elementor` (formerly Anywhere Elementor) plugin is installed and its version in the WordPress plugins screen\n- Confirm whether any Author-role accounts can publish posts using the Elementor widgets","fix":"- Update the `Dynific Addons for Elementor` plugin to `1.3.1` or later","status":"open","published_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:49+00:00","updated_at":"2026-11-11T06:27:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T06:27:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the `Dynific Addons for Elementor` plugin to `1.3.1` or later","reach":"internet","title":"WordPress Dynific Addons for Elementor: stored script runs in viewers' sessions","impact":"medium","summary":"The Dynific Addons for Elementor WordPress plugin does not escape a user profile value in an Elementor widget attribute. An author can store a script in a post that runs in the browser of anyone who views it, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in administrator sessions, enabling site takeover","analyst_note":"","how_to_check":"- Check whether the `Dynific Addons for Elementor` (formerly Anywhere Elementor) plugin is installed and its version in the WordPress plugins screen\n- Confirm whether any Author-role accounts can publish posts using the Elementor widgets","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-1.3.1-or-later","plugin-not-installed","no-author-accounts"],"who_is_affected":"Sites running the Dynific Addons for Elementor plugin before 1.3.1 with Elementor widgets in use. The attacker needs an Author-role account, and the script runs when a logged-in user, including an administrator, views the attacker's post. Sites without the plugin, or with it at 1.3.1 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4600,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117521':14A,17A '-2026':13A,16A '1.3.1':75C 'addon':3A,26B,66C 'administr':63B,118C 'allow':98C 'anyon':58B,115C 'anywher':70C 'attack':124C 'attribut':42B,91C 'authent':99C 'author':44B,103C,125C 'browser':56B 'control':82C 'cross':130C 'cross-sit':129C 'cve':12A,15A 'dynif':2A,25B,65C 'elementor':5A,18B,28B,40B,68C,71C,96C 'escap':33B,78C 'execut':110C 'former':69C 'host':22B 'includ':62B,116C 'one':93C 'output':86C 'packag':19B 'payload':108C 'plugin':30B,73C 'post':51B,122C 'profil':36B,83C 'quot':90C 'result':126C 'role':104C 'run':8A,53B 'script':7A,48B,132C 'self':21B 'self-host':20B 'session':11A,113C 'site':131C 'store':6A,46B,106C,128C 'user':35B,81C,100C 'user-control':80C 'valu':37B,84C 'view':60B,120C 'viewer':10A 'widget':41B,97C 'wordpress':1A,23B,29B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dynific Addons for Elementor plugin before 1.3.1 with Elementor widgets in use. The attacker needs an Author-role account, and the script runs when a logged-in user, including an administrator, views the attacker's post. Sites without the plugin, or with it at 1.3.1 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117521':14A,17A '-2026':13A,16A 'addon':3A 'cve':12A,15A 'dynif':2A 'elementor':5A 'run':8A 'script':7A 'session':11A 'store':6A 'viewer':10A 'wordpress':1A","search_b":"'addon':26B 'administr':63B 'anyon':58B 'attribut':42B 'author':44B 'browser':56B 'dynif':25B 'elementor':18B,28B,40B 'escap':33B 'host':22B 'includ':62B 'packag':19B 'plugin':30B 'post':51B 'profil':36B 'run':53B 'script':48B 'self':21B 'self-host':20B 'store':46B 'user':35B 'valu':37B 'view':60B 'widget':41B 'wordpress':23B,29B","search_c":"'1.3.1':75C 'addon':66C 'administr':118C 'allow':98C 'anyon':115C 'anywher':70C 'attack':124C 'attribut':91C 'authent':99C 'author':103C,125C 'control':82C 'cross':130C 'cross-sit':129C 'dynif':65C 'elementor':68C,71C,96C 'escap':78C 'execut':110C 'former':69C 'includ':116C 'one':93C 'output':86C 'payload':108C 'plugin':73C 'post':122C 'profil':83C 'quot':90C 'result':126C 'role':104C 'script':132C 'session':113C 'site':131C 'store':106C,128C 'user':81C,100C 'user-control':80C 'valu':84C 'view':120C 'widget':97C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117521","severity":null,"published_at":"2026-11-11T06:17:14+00:00","modified_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}