CVE-2026-12231 in Exclusive Addons for Elementor Plugin
Summary
by MITRE • 08/02/2026
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/02/2026
The Exclusive Addons for Elementor plugin presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 2.7.9.8. This security flaw resides within the plugin's handling of the 'exad_infobox_image' parameter, which fails to implement proper input sanitization measures and output escaping mechanisms. The vulnerability specifically targets authenticated attackers who possess Contributor-level access or higher privileges within WordPress environments, making it particularly concerning given the relatively low privilege requirements needed to exploit this weakness.
The technical nature of this vulnerability stems from inadequate validation of user-supplied input data within the plugin's backend processing functions. When administrators or contributors upload or modify content through the Elementor interface using Exclusive Addons features, the 'exad_infobox_image' parameter accepts unfiltered input that can contain malicious script code. The absence of proper output escaping means that when this stored data is later rendered on web pages, the embedded scripts execute in the context of users who view those pages, creating a persistent cross-site scripting attack vector that can affect any user with sufficient privileges to access affected content.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the capability to perform various malicious activities including session hijacking, credential theft, and data exfiltration. An attacker with Contributor-level access can inject scripts that redirect users to malicious sites, steal cookies and authentication tokens, or even modify content in ways that compromise the integrity of the entire WordPress installation. The stored nature of this vulnerability means that once exploited, the malicious payloads persist indefinitely until manually removed from the database, potentially affecting countless users over extended periods.
This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and demonstrates characteristics consistent with ATT&CK technique T1566 related to malicious content delivery through compromised web applications. Organizations should immediately implement mitigation strategies including plugin updates to versions that address the sanitization issues, implementing role-based access controls to limit contributor privileges where possible, and conducting thorough security audits of all installed plugins. Additionally, regular monitoring of database content for suspicious script injections and implementing Content Security Policies can provide additional layers of protection against exploitation of this stored XSS vulnerability.
The security implications of this flaw underscore the critical importance of proper input validation and output escaping in web application development, particularly within content management systems where user-generated content processing occurs. WordPress plugin developers must prioritize secure coding practices and regular vulnerability assessments to prevent attackers from leveraging such weaknesses to compromise entire sites and their users' data. Organizations should also consider implementing automated security scanning tools that can detect similar sanitization failures across their plugin ecosystem to prevent exploitation of related vulnerabilities.