CVE-2026-114188: WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress AnyWhere Elementorto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The attack can be conducted remotely over the network with low attack complexity.
Which versions are affected?
AnyWhere Elementor versions through 1.3.0 are affected. The earliest affected version is not specified.
What impact can successful exploitation have?
This is a stored XSS issue with low confidentiality, integrity, and availability impact in the CVSS assessment. The scope is changed, meaning the vulnerable component can affect another security authority.