WordPress Plugin Vulnerabilities

The Plus Addons for Elementor < 6.4.12 - Contributor+ Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
the-plus-addons-for-elementor-page-builder
Fixed in 6.4.12

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0114a028-42ef-4668-815f-d62494565116

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (Medium)

Miscellaneous

Original Researcher
theviper17y
Verified
No
WPVDB ID
1e1d034a-9982-4d29-89d7-820425f3826a

Timeline

Publicly Published
2026-05-21 (about 4 months ago)
Added
2026-07-22 (about 2 months ago)
Last Updated
2026-07-22 (about 2 months ago)

Other

Published
Title
Published
2025-05-23
Title
4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-09-23
Title
Gum Elementor Addon < 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2017-01-26
Title
WordPress 4.3.0-4.7.1 - Cross-Site Scripting (XSS) in posts list table
Published
2024-04-05
Title
Bold Page Builder < 4.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode
Published
2022-09-19
Title
Social Rocket < 1.3.3 - Admin+ Stored Cross-Site Scripting