CVE-2026-117522 · Package
NO FIX YET · SEE WHAT TO DO
The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, does not escape post titles in one of its Elementor widgets. A user with the Author role can publish a post whose title runs as a script when anyone, including an administrator, views it.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Dynific Addons for Elementor plugin before 1.3.1 that use its Elementor widgets to output post titles. The attacker must hold the Author role, so sites with no untrusted authors are at lower risk, but an administrator viewing the malicious post is the intended target.
Not affected if plugin-version-1.3.1-or-later, widget-not-used
Who cares elementor, self-hosted, wordpress
1.3.1.1.3.1 or later.The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.