Stored Cross-Site Scripting Vulnerability in Dynific Addons for Elementor by WordPress
CVE-2026-117522

Currently unrated

Key Information:

Vendor

WordPress
Status
Dynific Addons For Elementor (formerly Anywhere Elementor)
Vendor
CVE Published:
11 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-117522?

The Dynific Addons for Elementor plugin for WordPress, prior to version 1.3.1, is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises due to insufficient escaping of the post title when it is outputted within a quoted HTML attribute in an Elementor widget. Authenticated users with the Author role can exploit this vulnerability by publishing a post with a title that executes script code in the session of viewers, including administrators. This can lead to unauthorized actions, data leakage, and potentially compromise website security.

Affected Version(s)

Dynific Addons for Elementor (formerly Anywhere Elementor) 0 < 1.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-117522 - Proof of Concept

References

https://wpscan.com/vulnerability/405f11c6-7d5f-48f8-a38c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael P. Cigana
WPScan
.