CVE-2026-125743: WordPress Elementor Addon Elements plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPVibes Elementor Addon Elementsto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Installations using Elementor Addon Elements versions through 1.5 are affected. The available data does not identify an unaffected fixed version.
What level of access does an attacker need?
The attack vector is network-accessible, has low attack complexity, and requires low privileges. Exploitation also requires user interaction.
What is the expected impact if exploitation succeeds?
The vulnerability is stored XSS and is rated medium severity with a 6.5 CVSS score. The supplied vector indicates low confidentiality, integrity, and availability impact, with scope changed.