The Plus Addons CVE-2026-116848

Exploitation requires an authenticated account with sufficient privileges to submit the stored content (PR:L - not an anonymous visitor), and it requires victim interaction (UI:R): a separate user must view the page where the payload is stored for the script to fire. It affects The Plus Addons for Elementor Page Builder Lite versions from n/a through 6.5.3; the specific plugin feature or input field that fails to neutralize input is not described in the available sources. Limiting factors that reduce realistic risk: the attacker needs a valid low-privilege account on the target site, and the payload only triggers when a victim loads the affected content, so sites that restrict content-contribution roles are less exposed.

This is a moderate-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in a WordPress plugin, and the signals are internally consistent rather than conflicting: the vector requires low privileges (PR:L) and victim interaction (UI:R), which matches the typical WordPress stored-XSS pattern where an authenticated contributor-or-above user injects a payload that executes when another user views the page. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation - exploitation status is no public exploit identified at time of analysis. The only reference is a Patchstack advisory, which is a vulnerability database entry, not verified working exploit code. The vendor/aggregator priority is this_month, not an act_now/emergency label, so this is a routine-patch item rather than a drop-everything emergency. Net: a real but not urgent issue - the network attack vector is offset by the authentication requirement and the need for a privileged-enough account plus victim interaction, keeping real-world risk in the medium band. Note the input lists A:L (availability impact), which is atypical for stored XSS and likely a conservative aggregator scoring choice; verify if availability impact matters to your prioritization.

An attacker who already holds a low-privileged authenticated account (e.g. contributor) on a WordPress site running the plugin submits content containing a malicious script payload through an affected plugin field. The payload is stored and later executes in the browser of another user - such as an administrator or site visitor - who views the page, enabling session/token theft or actions in that user's context. No working public exploit was identified in the supplied data; only a Patchstack advisory reference exists.