Cross-Site Scripting Vulnerability in Elementor Addon Elements by WPVibes
CVE-2026-125743

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Elementor Addon Elements
Vendor
CVE Published:
11 November 2026

What is CVE-2026-125743?

The Elementor Addon Elements plugin by WPVibes contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This flaw allows an attacker to inject malicious scripts via certain input fields, which can then be executed in the context of the user's browser. As a result, attackers may compromise user sessions, steal sensitive data, or manipulate the user experience. All versions up to 1.5 are affected, making immediate updates essential for maintaining website security.

Affected Version(s)

Elementor Addon Elements 0 <= 1.5

References

https://patchstack.com/database/wordpress/plugin/addon-el...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nh4tvd | Patchstack Bug Bounty Program
.