{"id":"CVE-2026-119465","kind":"vulnerability","aliases":["CVE-2026-119465"],"related":[],"title":"WordPress Elementor Addon Elements plugin leaks embedded sensitive data","description":"Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.","summary":"The Elementor Addon Elements WordPress plugin, by WPVibes, sends sensitive information inside responses where it should not appear. An attacker can retrieve that embedded data from the plugin's output.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Addon Elements for Elementor plugin (addon-elements-for-elementor-page-builder) in the WordPress admin under Plugins.\n- Compare the version against the affected range: `1.15` and earlier, with the sources saying 'from n/a through 1.15'.","fix":null,"status":"open","published_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:50+00:00","updated_at":"2026-11-07T10:48:50+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-07T10:48:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Elementor Addon Elements plugin leaks embedded sensitive data","impact":"medium","summary":"The Elementor Addon Elements WordPress plugin, by WPVibes, sends sensitive information inside responses where it should not appear. An attacker can retrieve that embedded data from the plugin's output.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Embedded sensitive data is readable by an outside visitor.","analyst_note":"Check the NVD entry and the WPVibes plugin changelog for the fixed version and the exact data exposed.","how_to_check":"- Check the installed version of the Addon Elements for Elementor plugin (addon-elements-for-elementor-page-builder) in the WordPress admin under Plugins.\n- Compare the version against the affected range: `1.15` and earlier, with the sources saying 'from n/a through 1.15'.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Addon Elements for Elementor plugin at version 1.15 or earlier are in the affected range. The sources do not say which configurations or pages expose the data, so whether a given site is reachable is unknown. Sites that do not run this plugin are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4230,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119465':12A,15A '-2026':11A,14A '1.15':85C 'addon':3A,24B,63C,66C,80C 'addon-elements-for-elementor-page-build':65C 'affect':78C 'allow':72C 'appear':39B 'attack':41B 'builder':71C 'cve':10A,13A 'data':9A,46B,58C 'data.this':76C 'element':4A,25B,64C,67C,81C 'elementor':2A,16B,23B,62C,69C,79C 'embed':7A,45B,74C 'host':20B 'inform':32B,55C 'insert':52C 'insid':33B 'issu':77C 'leak':6A 'n/a':83C 'output':51B 'page':70C 'plugin':5A,27B,49B 'respons':34B 'retriev':43B,73C 'self':19B 'self-host':18B 'send':30B 'sensit':8A,31B,54C,75C 'sent':57C 'vulner':59C 'wordpress':1A,21B,26B 'wpvibe':29B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Addon Elements for Elementor plugin at version 1.15 or earlier are in the affected range. The sources do not say which configurations or pages expose the data, so whether a given site is reachable is unknown. Sites that do not run this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119465':12A,15A '-2026':11A,14A 'addon':3A 'cve':10A,13A 'data':9A 'element':4A 'elementor':2A 'embed':7A 'leak':6A 'plugin':5A 'sensit':8A 'wordpress':1A","search_b":"'addon':24B 'appear':39B 'attack':41B 'data':46B 'element':25B 'elementor':16B,23B 'embed':45B 'host':20B 'inform':32B 'insid':33B 'output':51B 'plugin':27B,49B 'respons':34B 'retriev':43B 'self':19B 'self-host':18B 'send':30B 'sensit':31B 'wordpress':21B,26B 'wpvibe':29B","search_c":"'1.15':85C 'addon':63C,66C,80C 'addon-elements-for-elementor-page-build':65C 'affect':78C 'allow':72C 'builder':71C 'data':58C 'data.this':76C 'element':64C,67C,81C 'elementor':62C,69C,79C 'embed':74C 'inform':55C 'insert':52C 'issu':77C 'n/a':83C 'page':70C 'retriev':73C 'sensit':54C,75C 'sent':57C 'vulner':59C 'wpvibe':61C","first_public_at":"2026-11-07T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119465","severity":null,"published_at":"2026-11-07T10:17:07+00:00","modified_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}