CVE-2026-95596: WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates that the attack can be performed remotely with low complexity and without authentication, but it requires user interaction. Exploitation involves getting a user to interact with attacker-controlled content or a crafted request.

Q: Which installations should be treated as affected?

ShopBuilder – Elementor WooCommerce Builder Addons versions through 3.4.1 are affected. The supplied data does not identify a fixed version or any configuration requirements.

Q: What is the likely impact if exploitation succeeds?

The issue is reflected XSS, which can allow attacker-supplied script to execute in a victim's browser in the context of the affected site. The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.

Affected Software

1 affected component

Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons<=3.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ShopBuilder – Elementor WooCommerce Builder Addons to a version that resolves this vulnerability.
Fixed in 3.4.2

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates that the attack can be performed remotely with low complexity and without authentication, but it requires user interaction. Exploitation involves getting a user to interact with attacker-controlled content or a crafted request.

Which installations should be treated as affected?

ShopBuilder – Elementor WooCommerce Builder Addons versions through 3.4.1 are affected. The supplied data does not identify a fixed version or any configuration requirements.

What is the likely impact if exploitation succeeds?

The issue is reflected XSS, which can allow attacker-supplied script to execute in a victim's browser in the context of the affected site. The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed.

CVE-2026-95596: WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations should be treated as affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations should be treated as affected?

What is the likely impact if exploitation succeeds?