Cross-Site Scripting Vulnerability in WPBITS Addons for Elementor Page Builder
CVE-2026-39703

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WPbits Addons For Elementor Page Builder
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39703?

A Cross-site Scripting (XSS) vulnerability has been identified in the WPBITS Addons for Elementor Page Builder. This vulnerability allows an attacker to inject malicious scripts into web pages, which can be executed in the context of users visiting the site. Affected versions include all versions prior to or equal to 1.8.1. This flaw poses a significant risk as it could enable attackers to manipulate web content and steal sensitive information from users. It is crucial for users of the affected product to apply the necessary updates to mitigate potential risks.

Affected Version(s)

WPBITS Addons For Elementor Page Builder 0 <= 1.8.1

References

https://patchstack.com/database/Wordpress/Plugin/wpbits-a...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abu Hurayra | Patchstack Bug Bounty Program
.