{"id":"CVE-2026-126029","kind":"vulnerability","aliases":["CVE-2026-126029"],"related":[],"title":"WPZOOM Addons for Elementor: stored XSS via builder link URL parameter","description":"The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The WPZOOM Addons for Elementor WordPress plugin does not sanitize or escape a link URL field saved through its builder, up to and including version 1.4.20. An authenticated contributor can store a script that runs in the browser of anyone who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WPZOOM Addons for Elementor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","package","wordpress","wpzoom"],"not_affected_if":["no-untrusted-contributors","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `1.4.20` and below.\n- Confirm the plugin is active on the site with the Elementor builder in use.","fix":null,"status":"open","published_at":"2026-11-13T10:17:28+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","triaged_at":"2026-11-13T10:55:04+00:00","updated_at":"2026-11-13T10:55:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:55:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WPZOOM Addons for Elementor: stored XSS via builder link URL parameter","impact":"medium","summary":"The WPZOOM Addons for Elementor WordPress plugin does not sanitize or escape a link URL field saved through its builder, up to and including version 1.4.20. An authenticated contributor can store a script that runs in the browser of anyone who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","wpzoom"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' and editors' browsers, enabling session theft","analyst_note":"Check the WordPress.org plugin page or the Wordfence/NVD entry for a fixed version after 1.4.20.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `1.4.20` and below.\n- Confirm the plugin is active on the site with the Elementor builder in use.","plain_action":"","product_name":"WPZOOM Addons for Elementor","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-untrusted-contributors"],"who_is_affected":"Sites running the WPZOOM Addons for Elementor plugin at version 1.4.20 or earlier. The attacker must hold at least a contributor account, so sites that do not give contributor access to untrusted users face much lower risk. unknown whether a fixed version exists.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4654,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126029':14A,17A '-2026':13A,16A '1.4.20':51B,114C 'access':134C,150C 'action':92C 'addon':2A,28B,73C 'addons':19A 'anyon':65B 'arbitrari':139C 'attack':129C 'authent':53B,128C 'browser':63B 'builder':8A,45B,94C 'contributor':54B,132C 'contributor-level':131C 'cross':87C 'cross-sit':86C 'cve':12A,15A 'data':95C 'due':115C 'element':96C 'elementor':4A,21A,22B,30B,75C 'escap':37B,122C 'execut':146C 'field':41B 'for':20A 'includ':49B,113C 'inject':69B,138C,152C 'input':118C 'insuffici':117C 'level':133C 'link':9A,39B,100C,104C 'make':124C 'open':67B 'output':121C 'packag':23B 'page':70B,143C,153C 'paramet':11A,106C 'pin':102C 'plugin':32B,79C 'possibl':126C 'region':98C 'run':60B 'sanit':35B,119C 'save':42B,93C 'script':58B,89C,141C 'set':97C 'site':88C 'starter':76C 'store':5A,56B,85C 'templat':77C 'url':10A,40B,101C,105C 'user':149C 'version':50B,109C 'via':7A,90C 'vulner':83C 'web':140C 'whenev':147C 'widget':78C 'wordpress':24B,31B,81C 'wpzoom':1A,18A,25B,27B,72C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPZOOM Addons for Elementor plugin at version 1.4.20 or earlier. The attacker must hold at least a contributor account, so sites that do not give contributor access to untrusted users face much lower risk. unknown whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["addonsforelementor","wpzoomaddonsforelementor"],"ptokens":["addons","elementor","for","wpzoom"],"labels":["elementor","medium","package","vendor","wordpress","wpzoom"],"campaign_type":null,"search_a":"'-126029':14A,17A '-2026':13A,16A 'addon':2A 'addons':19A 'builder':8A 'cve':12A,15A 'elementor':4A,21A 'for':20A 'link':9A 'paramet':11A 'store':5A 'url':10A 'via':7A 'wpzoom':1A,18A 'xss':6A","search_b":"'1.4.20':51B 'addon':28B 'anyon':65B 'authent':53B 'browser':63B 'builder':45B 'contributor':54B 'elementor':22B,30B 'escap':37B 'field':41B 'includ':49B 'inject':69B 'link':39B 'open':67B 'packag':23B 'page':70B 'plugin':32B 'run':60B 'sanit':35B 'save':42B 'script':58B 'store':56B 'url':40B 'version':50B 'wordpress':24B,31B 'wpzoom':25B,27B","search_c":"'1.4.20':114C 'access':134C,150C 'action':92C 'addon':73C 'arbitrari':139C 'attack':129C 'authent':128C 'builder':94C 'contributor':132C 'contributor-level':131C 'cross':87C 'cross-sit':86C 'data':95C 'due':115C 'element':96C 'elementor':75C 'escap':122C 'execut':146C 'includ':113C 'inject':138C,152C 'input':118C 'insuffici':117C 'level':133C 'link':100C,104C 'make':124C 'output':121C 'page':143C,153C 'paramet':106C 'pin':102C 'plugin':79C 'possibl':126C 'region':98C 'sanit':119C 'save':93C 'script':89C,141C 'set':97C 'site':88C 'starter':76C 'store':85C 'templat':77C 'url':101C,105C 'user':149C 'version':109C 'via':90C 'vulner':83C 'web':140C 'whenev':147C 'widget':78C 'wordpress':81C 'wpzoom':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126029","severity":null,"published_at":"2026-11-13T10:17:28+00:00","modified_at":"2026-11-13T10:17:28+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","fetched_at":"2026-11-13T10:47:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}