What is the CVSS score of CVE-2026-12231?

CVE-2026-12231 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Exclusive Addons Elementor CVE-2026-12231

EUVD-2026-51984 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-02 Wordfence

GHSA-hh26-4vf3-jpr2

WordPress XSS Exclusive Addons For Elementor Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Victim must visit the injected page for payload execution, warranting UI:R; all other metrics align with the network-delivered, low-privilege stored XSS with scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 02, 2026 - 09:21 vuln.today

CVE Published

Aug 02, 2026 - 08:33 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Exclusive Addons for Elementor (WordPress plugin, all versions through 2.7.9.8) allows any authenticated contributor-level WordPress user to permanently inject arbitrary JavaScript into pages via the exad_infobox_image parameter of the infobox widget. The injected payload executes in the browser of any user who subsequently views the compromised page, including administrators, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Wordfence's changeset reference suggests source-code-level details are publicly accessible.

Technical ContextAI

Exclusive Addons for Elementor is a third-party addon bundle for the Elementor WordPress page builder, developed by Tim Strifler (CPE: cpe:2.3:a:timstrifler:exclusive_addons_for_elementor). The vulnerability resides in the infobox widget's PHP rendering logic, specifically in elements/infobox/infobox.php around lines 975-1095 as referenced by the Wordfence advisory. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the exad_infobox_image parameter is accepted from authenticated user input and echoed into page output without adequate sanitization or output escaping. Because WordPress contributor-level users can author and publish posts containing Elementor widgets, they control this input path. The CVSS scope-change metric (S:C) reflects that execution occurs outside the WordPress application boundary - in the victim's browser context - enabling cross-origin data access and action-on-behalf-of attacks.

RemediationAI

The primary remediation is to update the Exclusive Addons for Elementor plugin to a version beyond 2.7.9.8. A code-level fix has been committed to the WordPress plugin repository at changeset 3583929 (https://plugins.trac.wordpress.org/changeset/3583929/); however, the exact released patched version number is not independently confirmed from the available source intelligence - verify the current version in the WordPress plugin directory before updating. As an immediate compensating control on sites where updating is not immediately feasible, restrict or eliminate contributor-level user accounts, particularly those belonging to untrusted or external authors, as this closes the attacker's required access path without disabling the plugin entirely. If contributor accounts are operationally necessary, consider disabling or restricting access to the Exclusive Addons infobox widget through the Elementor role manager until a patched release is confirmed. Be aware that contributor restriction may impact legitimate guest-author workflows.