CVE-2026-116848 in The Plus Addons for Elementor Page Builder Lite Plugin
Summary
by MITRE • 10/29/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this is classified under CWE-79 in the Common Weakness Enumeration framework, which addresses flaws where user-controllable input is not properly validated before being included in web pages sent to other users. In the context of POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite, the flaw allows an attacker to inject malicious scripts that are stored on the target server and subsequently executed when legitimate users view the affected content. This specific variant is categorized as Stored XSS because the injected payload persists within the application's data store rather than being transient in a URL parameter or HTTP header. The vulnerability affects versions of The Plus Addons for Elementor Page Builder Lite ranging from n/a through version 6.5.3, indicating that any installation utilizing these older iterations remains susceptible to exploitation unless patched or mitigated.
From an operational perspective, the impact of this Stored XSS vulnerability is severe because it compromises the trust relationship between the user and the website. Unlike reflected XSS where the victim must click a specially crafted link, stored XSS automatically executes in the context of every visitor who views the compromised page. This significantly increases the attack surface as any authenticated or unauthenticated user accessing the affected content becomes a potential target. Attackers can leverage this capability to steal session cookies, hijack administrative accounts, deface websites, redirect users to malicious phishing sites, or deploy further malware through drive-by downloads. The persistence of the script means that even if the initial injection point is secured, previously injected payloads continue to pose a risk until they are manually removed from the database or content repository.
In terms of adversary tactics and techniques, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution in web browsers. An attacker utilizing this flaw would likely follow an initial access phase by injecting the script via a vulnerable input field within the Elementor page builder interface. Once stored, during the persistence and impact phases of the kill chain, the malicious code executes client-side, allowing for credential harvesting or session hijacking without requiring additional social engineering beyond the initial upload or content creation step. The lack of output encoding allows the browser to interpret the injected text as executable code rather than plain data, bypassing standard security controls that rely on distinguishing between script and markup.
To mitigate this vulnerability, immediate action is required by upgrading The Plus Addons for Elementor Page Builder Lite to a version newer than 6.5.3 where the input validation logic has been corrected. If an upgrade is not immediately feasible, administrators should implement strict input sanitization at the application level using allow-listing techniques rather than block-listing known malicious characters. Additionally, enabling Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby preventing the injected payload from loading external resources or executing inline scripts where possible. Regular security audits and code reviews focusing on how user input is handled during page generation processes are essential for maintaining long-term resilience against such injection-based attacks.