Stored Cross-Site Scripting in Plus Addons for Elementor Plugin
CVE-2026-3311

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
The Plus Addons For Elementor – Addons For Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Vendor
CVE Published:
8 April 2026

What is CVE-2026-3311?

The Plus Addons for Elementor plugin for WordPress exhibits a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on attributes supplied by users. This security flaw affects all versions up to and including 6.4.9. Authenticated attackers with contributor-level access or higher can exploit the Progress Bar shortcode, enabling them to inject arbitrary web scripts into pages. When a user accesses these compromised pages, the injected scripts are executed, posing significant security risks.

Affected Version(s)

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce 0 <= 6.4.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3473275/the-...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio
.