CVE-2026-114184: WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPVibes Elementor Addon Elementsto a version that resolves this vulnerability.Fixed in 1.14.5
Event History
Frequently Asked Questions
Does an attacker need an account to exploit this issue?
Yes. The CVSS vector indicates low privileges are required, so an unauthenticated attacker alone would not meet the stated exploitation conditions. User interaction is also required.
How accessible is exploitation from a network perspective?
The issue is rated with network attack vector and low attack complexity. This indicates exploitation can be attempted remotely once the required low-privileged access and user interaction conditions are met.
What is the expected security impact if exploitation succeeds?
The CVSS assessment indicates low confidentiality, integrity, and availability impact, with scope changed. The stated severity is medium with a score of 6.5.