CVE-2026-117522: Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Author role can exploit it by publishing a post with a crafted title. The script runs when another user views the affected post through the vulnerable Elementor widget.
Are administrators at risk?
Yes. An administrator can be affected if they view a post containing the crafted title, because the stored script executes in the viewer's session.
Which plugin versions are affected?
Versions of Dynific Addons for Elementor before 1.3.1 are affected. Updating to version 1.3.1 or later addresses the identified vulnerable version range.
How can I check whether content has already been weaponized?
Review posts published by Author-level accounts for suspicious or unexpected HTML-like characters in titles, particularly titles designed to break out of a quoted HTML attribute. Prioritize posts rendered using the affected Post Image widget.