The Plus Addons For Elementor Addons For Elementor Page Templates Widgets Mega Menu Woocommerce
CVE-2026-3311
|
EUVD-2026-20056
MEDIUM
GHSA-x8v6-ww3x-gccf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The The Plus Addons for Elementor - Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Progress Bar shortcode in all versions up to, and including, 6.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in The Plus Addons for Elementor plugin for WordPress (all versions up to 6.4.9) allows authenticated attackers with contributor-level access and above to inject arbitrary JavaScript into pages via the Progress Bar shortcode due to insufficient input sanitization and output escaping. When other users access affected pages, the injected scripts execute in their browsers, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
This vulnerability is a classic Stored XSS (CWE-79) affecting a WordPress plugin that extends the Elementor page builder. The Progress Bar shortcode component fails to properly sanitize user-supplied shortcode attributes before storing them in the database and fails to escape them during output rendering. WordPress shortcodes accept arbitrary key-value pairs as attributes; without sanitization during input processing (using functions like wp_kses_post() or sanitize_text_field()) and output escaping (using esc_attr() or esc_html()), attackers can embed malicious JavaScript. The vulnerability is stored, meaning the payload persists in the WordPress database and executes for all users viewing the affected page, including administrators and other contributors. The CPE cpe:2.3:a:posimyththemes:the_plus_addons_for_elementor_-_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce confirms this affects the specific Posimyth Themes plugin distributed via WordPress.org plugins repository.
RemediationAI
Update The Plus Addons for Elementor plugin immediately to the first patched version released after 6.4.9. Vendor patch information is available via the official WordPress changeset reference at https://plugins.trac.wordpress.org/changeset/3473275/the-plus-addons-for-elementor-page-builder. Additionally, review all pages and posts containing Progress Bar shortcodes created by contributor-level users for any suspicious attribute injection, and audit WordPress user access logs for unauthorized changes. As an interim measure on sites that cannot immediately patch, restrict contributor-level user access to page editing or disable the Progress Bar shortcode using custom code until the update is available. Verify the patch by checking the plugin version in WordPress admin (Plugins > Installed Plugins) and confirm it exceeds 6.4.9.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today