What is the CVSS score of CVE-2026-32429?

CVE-2026-32429 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Magical Addons For Elementor are affected by CVE-2026-32429?

CVE-2026-32429 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2026-32429?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Magical Addons For Elementor CVE-2026-32429

EUVD-2026-11962 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 Patchstack

XSS Magical Addons For Elementor Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11962

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in Magical Addons For Elementor, a WordPress plugin for the Elementor page builder, affecting versions up to and including 1.4.1. An authenticated attacker with low privileges can inject malicious JavaScript code that persists in the application and executes in the browsers of other users, potentially leading to session hijacking, credential theft, or defacement. This is a post-authentication vulnerability with user interaction required, making it moderately exploitable in real-world WordPress environments where multiple users collaborate on page design.

Technical ContextAI

Magical Addons For Elementor is a WordPress plugin (CPE: cpe:2.3:a:noor_alam:magical-addons-for-elementor) that extends the Elementor page builder with additional widgets and functionality. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input is not properly sanitized or escaped before being stored in the database and subsequently rendered in HTML/JavaScript contexts. The root cause is insufficient input validation and output encoding in the plugin's addon elements, likely in widget configuration parameters or custom field handlers. Attackers can exploit this by crafting malicious payloads in plugin settings or widget options that execute when administrators or other users view or edit pages containing those widgets.

RemediationAI

Immediately update Magical Addons For Elementor to the latest available version beyond 1.4.1, which should contain fixes for the Stored XSS vulnerability. Visit the WordPress Plugin Directory or the plugin author's website to download the patched version, then upload and activate it within the WordPress admin interface (Plugins > Installed Plugins > Update). If an immediate patch is not available, restrict plugin access to trusted administrators only by managing WordPress user roles and capabilities via the wp-config.php file or a user role management plugin, disable the plugin temporarily until a patch is released, and implement a Web Application Firewall (WAF) rule to detect and block common XSS payloads in POST requests to the plugin's admin endpoints. Additionally, audit all pages and posts edited with this plugin for suspicious content and consider restoring from a known-clean backup if compromise is suspected.