{"id":"CVE-2026-117522","kind":"vulnerability","aliases":["CVE-2026-117522"],"related":[],"title":"Dynific Addons for Elementor: post titles run scripts in visitors' browsers","description":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting.","summary":"The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, does not escape post titles in one of its Elementor widgets. A user with the Author role can publish a post whose title runs as a script when anyone, including an administrator, views it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["plugin-version-1.3.1-or-later","widget-not-used"],"how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress admin plugin list; unknown if it is older than `1.3.1`.\n- Look for the plugin's Elementor widgets on pages that output post titles inside HTML attributes.","fix":"- Dynific Addons for Elementor (formerly Anywhere Elementor): move to `1.3.1` or later.","status":"open","published_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:49+00:00","updated_at":"2026-11-11T06:27:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:49Z","model":"claude-haiku-5-5","output":{"fix":"- Dynific Addons for Elementor (formerly Anywhere Elementor): move to `1.3.1` or later.","reach":"internet","title":"Dynific Addons for Elementor: post titles run scripts in visitors' browsers","impact":"medium","summary":"The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, does not escape post titles in one of its Elementor widgets. A user with the Author role can publish a post whose title runs as a script when anyone, including an administrator, views it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in an administrator's session, enabling account takeover","analyst_note":"","how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress admin plugin list; unknown if it is older than `1.3.1`.\n- Look for the plugin's Elementor widgets on pages that output post titles inside HTML attributes.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-1.3.1-or-later","widget-not-used"],"who_is_affected":"Sites running the Dynific Addons for Elementor plugin before 1.3.1 that use its Elementor widgets to output post titles. The attacker must hold the Author role, so sites with no untrusted authors are at lower risk, but an administrator viewing the malicious post is the intended target.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4594,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117522':14A,17A '-2026':13A,16A '1.3.1':33B,78C 'addon':2A,26B,69C 'administr':65B,122C 'allow':99C 'anyon':62B,119C 'anywher':73C 'attribut':92C 'authent':100C 'author':49B,104C 'browser':11A 'cross':130C 'cross-sit':129C 'cve':12A,15A 'dynif':1A,25B,68C 'elementor':4A,18B,28B,43B,71C,74C,97C 'escap':36B,81C 'execut':112C 'former':72C 'host':22B 'html':91C 'includ':63B,120C 'one':40B,94C 'output':86C 'packag':19B 'plugin':30B,76C 'post':5A,37B,54B,83C,109C 'publish':52B,107C 'quot':90C 'result':126C 'role':50B,105C 'run':7A,57B 'script':8A,60B,114C,132C 'self':21B 'self-host':20B 'session':117C 'site':131C 'store':128C 'titl':6A,38B,56B,84C,111C 'user':46B,101C 'version':32B 'view':66B,124C 'visitor':10A 'whose':55B,110C 'widget':44B,98C 'wordpress':23B,29B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dynific Addons for Elementor plugin before 1.3.1 that use its Elementor widgets to output post titles. The attacker must hold the Author role, so sites with no untrusted authors are at lower risk, but an administrator viewing the malicious post is the intended target.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117522':14A,17A '-2026':13A,16A 'addon':2A 'browser':11A 'cve':12A,15A 'dynif':1A 'elementor':4A 'post':5A 'run':7A 'script':8A 'titl':6A 'visitor':10A","search_b":"'1.3.1':33B 'addon':26B 'administr':65B 'anyon':62B 'author':49B 'dynif':25B 'elementor':18B,28B,43B 'escap':36B 'host':22B 'includ':63B 'one':40B 'packag':19B 'plugin':30B 'post':37B,54B 'publish':52B 'role':50B 'run':57B 'script':60B 'self':21B 'self-host':20B 'titl':38B,56B 'user':46B 'version':32B 'view':66B 'whose':55B 'widget':44B 'wordpress':23B,29B","search_c":"'1.3.1':78C 'addon':69C 'administr':122C 'allow':99C 'anyon':119C 'anywher':73C 'attribut':92C 'authent':100C 'author':104C 'cross':130C 'cross-sit':129C 'dynif':68C 'elementor':71C,74C,97C 'escap':81C 'execut':112C 'former':72C 'html':91C 'includ':120C 'one':94C 'output':86C 'plugin':76C 'post':83C,109C 'publish':107C 'quot':90C 'result':126C 'role':105C 'script':114C,132C 'session':117C 'site':131C 'store':128C 'titl':84C,111C 'user':101C 'view':124C 'whose':110C 'widget':98C 'wordpress':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117522","severity":null,"published_at":"2026-11-11T06:17:14+00:00","modified_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}