Skip to main content

Exclusive Addons Elementor CVE-2026-12231

| EUVDEUVD-2026-51984 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-02 Wordfence GHSA-hh26-4vf3-jpr2
WordPress XSS Exclusive Addons For Elementor
6.4
CVSS 3.1 · Vendor: Wordfence
Share

Severity by source

Vendor (Wordfence) PRIMARY
6.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
vuln.today AI
5.4 MEDIUM

Victim must visit the injected page for payload execution, warranting UI:R; all other metrics align with the network-delivered, low-privilege stored XSS with scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 02, 2026 - 09:21 vuln.today
CVE Published
Aug 02, 2026 - 08:33 cve.org
MEDIUM 6.4

DescriptionCVE.org

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Exclusive Addons for Elementor (WordPress plugin, all versions through 2.7.9.8) allows any authenticated contributor-level WordPress user to permanently inject arbitrary JavaScript into pages via the exad_infobox_image parameter of the infobox widget. The injected payload executes in the browser of any user who subsequently views the compromised page, including administrators, enabling session hijacking, credential theft, or malicious redirects. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain or compromise WordPress Contributor account
Delivery
Craft XSS payload targeting exad_infobox_image parameter
Exploit
Inject payload into infobox widget on published page
Execution
Victim user browses to injected page
Persist
Stored script executes in victim's browser
Impact
Exfiltrate session cookie or perform privileged actions as victim
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an attacker to hold a WordPress account with at least Contributor-level privileges on the target site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity stored XSS with a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers or compromises a contributor-level account on a target WordPress site - a common role granted to guest bloggers or editors-in-training. The attacker creates or edits a post using the Exclusive Addons infobox widget and injects a JavaScript payload (e.g., a cookie-stealing script) into the `exad_infobox_image` parameter, then publishes the page. …
Remediation The primary remediation is to update the Exclusive Addons for Elementor plugin to a version beyond 2.7.9.8. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Exclusive Addons For Elementor

View all
CVE-2024-1234 MEDIUM POC
6.4 Mar 13

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute

CVE-2024-3489 MEDIUM
6.4 May 02

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Countdow
CVE-2024-30177 MEDIUM
6.5 Mar 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons E
CVE-2024-30232 MEDIUM
6.5 Mar 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons E
CVE-2024-32557 MEDIUM
6.5 Apr 16

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons E
CVE-2024-4618 MEDIUM
6.4 May 15

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member
CVE-2024-2028 MEDIUM
6.4 Mar 13

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Covid-19 St
CVE-2026-11328 MEDIUM
6.4 Jul 07

Stored XSS in the Exclusive Addons for Elementor WordPress plugin (all versions up to and including 2.7.9.8) allows auth
CVE-2024-1414 MEDIUM
6.4 Mar 13

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Act
CVE-2024-1413 MEDIUM
6.4 Mar 13

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown T
CVE-2024-5332 MEDIUM
6.4 Jun 26

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Ca
CVE-2024-3985 MEDIUM
6.4 May 02

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Ca

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-12231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy