CVE-2026-119465 · Other
NO FIX YET
The Elementor Addon Elements WordPress plugin, by WPVibes, sends sensitive information inside responses where it should not appear. An attacker can retrieve that embedded data from the plugin's output.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Addon Elements for Elementor plugin at version 1.15 or earlier are in the affected range. The sources do not say which configurations or pages expose the data, so whether a given site is reachable is unknown. Sites that do not run this plugin are not affected.
Not affected if plugin-not-installed
Who cares elementor, self-hosted, wordpress
1.15 and earlier, with the sources saying 'from n/a through 1.15'.No fix yet, per the sources.
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.