CVE-2026-114185: WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network-reachable exploitation with low privileges and required user interaction. An attacker would need some level of authenticated access and a user to interact with the injected content.

Q: Which installations are in the affected range?

AnyWhere Elementor versions through 1.3.0 are identified as affected. The lower bound is listed as n/a.

Q: What is the potential impact of a successful exploit?

The supplied CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. The issue is a stored XSS vulnerability, so malicious content may persist and execute when viewed by an affected user.

Q: Is a fixed version identified in the available information?

No fixed or remediated version is provided. The available data only identifies versions through 1.3.0 as affected.

Published Nov 3, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/anywhere-elementor to a version that resolves this vulnerability.
Fixed in 1.3.1

Event History

Nov 3, 2026

CVE Published

via MITRE·04:59 PM

Data Sourced

via MITRE·04:59 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates network-reachable exploitation with low privileges and required user interaction. An attacker would need some level of authenticated access and a user to interact with the injected content.

Which installations are in the affected range?

AnyWhere Elementor versions through 1.3.0 are identified as affected. The lower bound is listed as n/a.

What is the potential impact of a successful exploit?

The supplied CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. The issue is a stored XSS vulnerability, so malicious content may persist and execute when viewed by an affected user.

Is a fixed version identified in the available information?

No fixed or remediated version is provided. The available data only identifies versions through 1.3.0 as affected.

CVE-2026-114185: WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations are in the affected range?

What is the potential impact of a successful exploit?

Is a fixed version identified in the available information?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations are in the affected range?

What is the potential impact of a successful exploit?

Is a fixed version identified in the available information?