CVE-2026-114184 in Elementor Addon Elements Plugin
Summary
by MITRE • 10/23/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the WPVibes Elementor Addon Elements plugin for WordPress, affecting versions ranging from initial releases up through version 1.14.4. Unlike reflected XSS attacks where malicious scripts are executed via manipulated URLs, stored vulnerabilities persist on the target server because user-supplied input is saved in databases or other storage mechanisms and subsequently rendered to users without adequate sanitization. This persistence mechanism significantly escalates the severity of the issue, as every visitor loading a page containing the injected payload becomes a potential victim, thereby amplifying the attack surface far beyond that of transient injection points.
From a technical perspective, the vulnerability likely stems from insufficient validation or encoding of user-controlled data before it is processed by Elementor’s rendering engine. When an attacker submits malicious JavaScript code through any input field managed by this addon—such as widget settings, custom HTML fields, or form inputs—the application fails to neutralize special characters that have meaning in a web browser context. Consequently, when the page containing these elements is generated and served to legitimate users, the browser interprets the embedded script as executable content rather than static data. This failure aligns directly with CWE-79, which categorizes improper handling of user input during dynamic HTML generation, leading to unintended code execution within the victim’s security context.
The operational impact of this vulnerability is substantial and multifaceted. An attacker can exploit this flaw to execute arbitrary JavaScript in the context of the affected website, effectively bypassing same-origin policies that protect users from malicious sites. This capability allows for session hijacking, where attackers steal authentication cookies or tokens to impersonate legitimate users, including administrators with elevated privileges. Furthermore, it enables defacement of web pages, redirection of traffic to phishing sites, and keylogging activities that capture sensitive information such as passwords and credit card numbers. In the context of WordPress ecosystems, where plugins often have broad access to site data, a successful exploit could lead to complete compromise of the underlying server infrastructure if combined with other vulnerabilities or misconfigurations.
This specific attack vector is well-documented in industry frameworks, mapping closely to MITRE ATT&CK technique T1059.007, which covers JavaScript execution as part of Command and Control or Collection phases depending on the payload’s intent. The persistence nature of stored XSS also correlates with techniques involving web shell deployment if the attacker gains sufficient access levels, although in this specific case, the primary risk remains client-side exploitation through browser-based script injection. Organizations relying on affected versions must recognize that the threat is not limited to a single interaction but persists until the malicious content is manually removed from the database or the vulnerable code path is patched.
Mitigation strategies should prioritize immediate remediation by upgrading the WPVibes Elementor Addon Elements plugin to a version later than 1.14.4, where developers have presumably implemented proper input sanitization and output encoding mechanisms such as HTML entity encoding for untrusted data. In scenarios where an upgrade is not immediately feasible, administrators can implement temporary compensating controls by restricting the roles allowed to use specific widget features or by deploying a Web Application Firewall that detects and blocks common XSS payloads in HTTP requests. Additionally, enforcing Content Security Policy headers on the web server can significantly reduce the impact of any successful injection attempts by preventing the execution of inline scripts unless they originate from trusted sources. Regular security audits and penetration testing should be conducted to verify that input validation is robust across all user-facing endpoints within the WordPress environment.