{"id":"CVE-2026-125743","kind":"vulnerability","aliases":["CVE-2026-125743"],"related":[],"title":"WordPress Elementor Addon Elements plugin: stored XSS through version 1.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.5.","summary":"The Elementor Addon Elements plugin for WordPress, made by WPVibes, has a stored cross-site scripting flaw in versions up to and including 1.5. An attacker who can get malicious script saved into a page can run it in the browser of anyone who views that page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"addon-elements-for-elementor-page-builder","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","other","wordpress","wpvibes"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Elementor Addon Elements plugin (addon-elements-for-elementor-page-builder) is installed on the WordPress site, in the Plugins screen.\n- Check the installed plugin version; versions up to and including `1.5` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","triaged_at":"2026-11-11T13:29:13+00:00","updated_at":"2026-11-11T13:29:13+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T13:29:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Elementor Addon Elements plugin: stored XSS through version 1.5","impact":"medium","summary":"The Elementor Addon Elements plugin for WordPress, made by WPVibes, has a stored cross-site scripting flaw in versions up to and including 1.5. An attacker who can get malicious script saved into a page can run it in the browser of anyone who views that page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","wpvibes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm the fixed version and whether authentication is required to store the payload, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-125743 and the WPVibes or WordPress plugin changelog.","how_to_check":"- Check whether the Elementor Addon Elements plugin (addon-elements-for-elementor-page-builder) is installed on the WordPress site, in the Plugins screen.\n- Check the installed plugin version; versions up to and including `1.5` are listed as affected.","plain_action":"","product_name":"addon-elements-for-elementor-page-builder","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Elementor Addon Elements plugin at version 1.5 or earlier are listed as affected. The sources do not say which roles can save the malicious content, whether a logged-in account is needed, or whether default settings are exposed. Sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000778,"input_tokens":4562,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125743':13A,16A '-2026':12A,15A '1.5':10A,52B,112C 'addon':3A,18A,30B,92C,95C,107C 'addon-elements-for-elementor-page-build':94C 'addon-elements-for-elementor-page-builder':17A 'affect':105C 'allow':101C 'anyon':71B 'attack':54B 'browser':69B 'builder':23A,100C 'cross':42B,85C 'cross-sit':41B,84C 'cve':11A,14A 'element':4A,31B,93C,96C,108C 'elementor':2A,21A,24B,29B,91C,98C,106C 'elements':19A 'flaw':45B 'for':20A 'generat':83C 'get':57B 'improp':76C 'includ':51B 'input':79C 'issu':104C 'made':35B 'malici':58B 'n/a':110C 'neutral':77C 'page':22A,63B,75B,82C,99C 'plugin':5A,32B 'run':65B 'save':60B 'script':44B,59B,87C 'site':43B,86C 'store':6A,40B,102C 'version':9A,47B 'view':73B 'vulner':88C 'web':81C 'wordpress':1A,26B,34B 'wpvibe':27B,37B,90C 'xss':7A 'xss.this':103C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Elementor Addon Elements plugin at version 1.5 or earlier are listed as affected. The sources do not say which roles can save the malicious content, whether a logged-in account is needed, or whether default settings are exposed. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["addonelementsforelementorpagebuilder"],"ptokens":["addon","builder","elementor","elements","for","page"],"labels":["elementor","medium","other","vendor","wordpress","wpvibes"],"campaign_type":null,"search_a":"'-125743':13A,16A '-2026':12A,15A '1.5':10A 'addon':3A,18A 'addon-elements-for-elementor-page-builder':17A 'builder':23A 'cve':11A,14A 'element':4A 'elementor':2A,21A 'elements':19A 'for':20A 'page':22A 'plugin':5A 'store':6A 'version':9A 'wordpress':1A 'xss':7A","search_b":"'1.5':52B 'addon':30B 'anyon':71B 'attack':54B 'browser':69B 'cross':42B 'cross-sit':41B 'element':31B 'elementor':24B,29B 'flaw':45B 'get':57B 'includ':51B 'made':35B 'malici':58B 'page':63B,75B 'plugin':32B 'run':65B 'save':60B 'script':44B,59B 'site':43B 'store':40B 'version':47B 'view':73B 'wordpress':26B,34B 'wpvibe':27B,37B","search_c":"'1.5':112C 'addon':92C,95C,107C 'addon-elements-for-elementor-page-build':94C 'affect':105C 'allow':101C 'builder':100C 'cross':85C 'cross-sit':84C 'element':93C,96C,108C 'elementor':91C,98C,106C 'generat':83C 'improp':76C 'input':79C 'issu':104C 'n/a':110C 'neutral':77C 'page':82C,99C 'script':87C 'site':86C 'store':102C 'vulner':88C 'web':81C 'wpvibe':90C 'xss.this':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125743","severity":null,"published_at":"2026-11-11T13:17:22+00:00","modified_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","fetched_at":"2026-11-11T13:27:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}