---
id: "CVE-2026-119465"
page: "https://infrastack.ai/live/CVE-2026-119465"
kind: "vulnerability"
aliases: ["CVE-2026-119465"]
title: "WordPress Elementor Addon Elements plugin leaks embedded sensitive data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["elementor", "other", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T10:17:07+00:00"
first_seen_at: "2026-11-07T10:46:40+00:00"
updated_at: "2026-11-07T10:48:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119465", "first_seen_at": "2026-11-07T10:46:40+00:00"}]
exploit_sources: []
---

# WordPress Elementor Addon Elements plugin leaks embedded sensitive data

Link for people: https://infrastack.ai/live/CVE-2026-119465 (this .md is for agents)

The Elementor Addon Elements WordPress plugin, by WPVibes, sends sensitive information inside responses where it should not appear. An attacker can retrieve that embedded data from the plugin's output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Addon Elements for Elementor plugin (addon-elements-for-elementor-page-builder) in the WordPress admin under Plugins.
- Compare the version against the affected range: `1.15` and earlier, with the sources saying 'from n/a through 1.15'.

## Timeline

- 2026-11-07T10:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119465

## From the sources

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_