EUVD-2026-116092Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
DeliveryInject script via plugin input field
-
ExploitPayload stored in page content
-
ExecutionVictim views affected page
-
PersistScript executes in victim browser
-
ImpactSession or account compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) able to submit input that the AnyWhere Elementor plugin stores, plus a subsequent victim who views the page containing the stored payload (UI:R). The affected software is the WPVibes AnyWhere Elementor plugin in all versions through 1.3.0. The specific input field, parameter, or plugin feature that fails to neutralize input is not described in the available sources. Exploitation is limited by the need for valid credentials and victim interaction, meaning it cannot be triggered by a fully unauthenticated remote attacker against a default install. |
| Impact | This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable exploitation but with meaningful limiters: PR:L means an authenticated low-privilege account is required, and UI:R means a victim must view the injected page. The scope change (S:C) reflects the classic stored-XSS pattern where script injected by one user executes in another user's browser session. The vuln.today decision label is 'this_month' - a scheduled-remediation priority, not act_now or emergency - which is consistent with the signals. There is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active exploitation; exploitation probability cannot be quantified from the available data. The only reference is the Patchstack database entry, which is a vulnerability record rather than verified working exploit code. Overall this is a real but not urgent issue: the authentication and user-interaction requirements plus the low (L) impact metrics place it below internet-facing unauthenticated flaws, and it should be patched on a normal maintenance cadence rather than treated as an emergency. |
| Exploit ScenarioDerived | An authenticated low-privilege WordPress user (e.g. a contributor or author with access to the AnyWhere Elementor plugin's input fields) injects a malicious script payload that is stored by the plugin. When an administrator or another user later views the page containing the stored payload, the script executes in their browser session. A public PoC reference exists (Patchstack database entry); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Stored cross-site scripting in the WPVibes AnyWhere Elementor WordPress plugin, affecting all versions through 1.3.0, lets a holder of a low-privileged authenticated WordPress account persist a script payload that later executes in the browser of any user viewing the affected page - potentially including site administrators. The CVSS 3.1 score is 6.5 with a scope change (S:C), reflecting that the injected script runs outside the plugin's own security boundary; the assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, so exploitation needs valid credentials plus victim interaction rather than a fully unauthenticated attack. No public exploit code or CISA KEV entry was identified at time of analysis, and the specific plugin field or parameter that fails to neutralize input is not described in the available sources.
RemediationAI
The supplied intelligence does not identify a specific fixed version - it only defines the vulnerable range as everything through AnyWhere Elementor 1.3.0 - so check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve for the current fixed release and upgrade the plugin to that version or later as the complete fix. Because no vendor-released patch version is confirmed in the available data, plan compensating controls in the interim, each with a trade-off: remove or deactivate the plugin if it is not essential (site loses its AnyWhere/Elementor template placement functionality), and tighten role assignments so that only trusted users hold accounts able to store content that the plugin renders, since the assessed vector requires low-privileged authenticated access (PR:L) - this narrows but does not eliminate the attack surface, as any surviving author can still reach the vulnerable path. Restricting or auditing stored content that flows into Elementor templates helps detect injected markup but requires manual review effort and can miss payloads, and a Content-Security-Policy that blocks inline and third-party script reduces execution likelihood at the cost of breaking legitimate inline scripts on the site. Victim interaction (UI:R) is required, so warnings to administrators about viewing untrusted submitted content are a partial, awareness-level mitigation only, not a substitute for upgrading once a fixed version is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AnyWhere Elementor is a WordPress plugin by WPVibes that renders Elementor-designed templates and content into arbitrary placements on a site, which means its output passes through normal WordPress page generation. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant: content accepted from a user is saved and later emitted into HTML without adequate encoding, so script executes in the victim's session on every render of the page. The CPE entry cpe:2.3:a:wpvibes:anywhere_elementor:*:*:*:*:*:*:*:* is a wildcard, confirming that the whole version range through 1.3.0 is treated as vulnerable rather than a single build. The scope-changed metric (S:C) in both the reported and assessed vectors signals that the impact crosses from the plugin into the surrounding WordPress site and user session, which is why stored XSS in admin-viewable pages matters even at low base privilege. The assessed vector reduces the availability impact to A:N relative to the reported score, so the expected outcome is script execution in the victim's browser with limited confidentiality and integrity impact rather than denial of service. Notably, the sources do not state which input field, shortcode attribute, widget setting, or template parameter carries the unneutralized data, so the exact injection point is unconfirmed and the trigger is not described in the available sources.
Know when Anywhere Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Authenticated low-privilege user needed (PR:L) and a victim must view the payload (UI:R); scope changes to the victim's browser (S:C); limited confidentiality/integrity impact and no availability impact typical of stored XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Anywhere Elementor
View allThe AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker
Sensitive information exposure in the WordPress plugin AnyWhere Elementor through version 1.3.0 lets low-privilege authe
AnyWhere Elementor, a WordPress plugin by WPVibes, ships with a missing authorization check (CWE-862) in versions up to
GitHub PoC
Exploit-DB