Elementor Addon Elements CVE-2026-114184

Requires an authenticated WordPress account with at least low-privilege content-contribution rights (PR:L) on a site running the Elementor Addon Elements plugin version through 1.14.4, plus Elementor itself as the host page builder. The stored payload only executes when another user (UI:R) subsequently loads the page containing the injected widget field, so exploitation depends on a victim rendering the affected content. Limiting factors: no unauthenticated path, dependency on self-registration or multi-author configurations to obtain a usable account, and the need for a higher-privileged victim to view the content for meaningful impact (session/account takeover).

This is a moderate-severity Stored XSS (CWE-79) with a vendor-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network attack vector and low complexity are offset by two real limiters encoded in the vector: PR:L means the attacker must already hold an authenticated, low-privilege account (typically Contributor/Author in WordPress terms), and UI:R means a victim must view the injected content for the payload to fire. No EPSS score, KEV listing, or POC is present in the provided data. There is no public exploit identified at time of analysis, and the issue is NOT in CISA KEV, so there is no evidence of active exploitation - this is a prioritization-by-patch-cadence issue, not an emergency. The scope change (S:C) is the one elevating factor, reflecting that injected script executes in the browser context of other users (e.g., administrators), enabling session/account takeover of a higher-privileged user. Net: a credible but not urgent risk, most relevant on multi-author WordPress sites where low-trust accounts exist. Note: the vendor vector includes A:L (availability impact), which is atypical for stored XSS and may be a conservative over-assignment - verify against the Patchstack advisory.

An attacker with a low-privilege authenticated WordPress account (e.g., Contributor) on a site running Elementor Addon Elements ≤1.14.4 injects a malicious script payload into an unsanitized field exposed by one of the addon's Elementor widgets. The payload is stored and later executes in the browser of an administrator or visitor who views the affected page, allowing session hijacking or actions performed as that victim. No public exploit code is identified at time of analysis.