CVE-2026-116848: WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
The Plus Addons for Elementor Page Builder Liteto a version that resolves this vulnerability.Fixed in 6.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is network-based, but exploitation requires low-privileged access and user interaction. An attacker would need an account with the required privileges and would need a victim to view or interact with the stored malicious content.
What versions are affected?
The affected range is listed as versions through 6.5.3. No fixed version is provided in the available data.
What is the likely impact if exploitation succeeds?
This is a stored XSS issue with low confidentiality, integrity, and availability impact. The scope is changed, meaning the injected script may affect users in a different security context from the attacker.