Cross-Site Scripting Vulnerability in The Plus Addons for Elementor Page Builder by POSIMYTH Innovations
CVE-2026-116848

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
The Plus Addons For Elementor Page Builder Lite
Vendor
CVE Published:
29 October 2026

What is CVE-2026-116848?

A Cross-Site Scripting (XSS) vulnerability exists in The Plus Addons for Elementor Page Builder Lite, developed by POSIMYTH Innovations. This flaw allows an attacker to inject malicious scripts into web pages, which could subsequently be executed in the browsers of users visiting the affected website. Specifically, this vulnerability affects versions from n/a up to 6.5.3 of the plugin. As a result, unpatched instances of this plugin may expose users to significant security risks, including data theft and session hijacking.

Affected Version(s)

The Plus Addons for Elementor Page Builder Lite 0 <= 6.5.3

References

https://patchstack.com/database/wordpress/plugin/the-plus...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Deva Parekh | Patchstack Bug Bounty Program
.