What is the CVSS score of CVE-2026-57376?

CVE-2026-57376 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of ElementInvader Addons are affected by CVE-2026-57376?

The ElementInvader Addons for Elementor WordPress plugin (versions through 1.4.3) contains a DOM-based cross-site scripting vulnerability enabling attackers to inject malicious scripts into user…

How to fix or mitigate CVE-2026-57376?

Within 24 hours, conduct a complete inventory of WordPress installations to identify all systems running ElementInvader Addons for Elementor and notify affected teams of the exposure. Within 7 days, disable the ElementInvader Addons for Elementor plugin across all affected WordPress installations until a vendor-released patch becomes available; if operational requirements prevent disablement, implement strict content security policies (CSP) with script-src restrictions to block injected scripts, and validate the remediation through automated WordPress security scanning. Within 30 days, monitor Patchstack security advisories and Elementor's release channels weekly for a vendor patch; once available, immediately deploy version 1.4.4 or later across all installations and conduct a follow-up WordPress plugin security audit to identify similar XSS vulnerabilities in other extensions.

ElementInvader Addons CVE-2026-57376

EUVD-2026-43444 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Elementinvader Addons For Elementor Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered DOM XSS needs victim interaction (UI:R) and no attacker auth (PR:N); script crosses into the site context (S:C) with low confidentiality/integrity impact and no real availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:06 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.3.

AnalysisAI

DOM-based cross-site scripting in the ElementInvader Addons for Elementor WordPress plugin (all versions up to and including 1.4.3) lets remote attackers inject client-side script that executes in a victim's browser when they interact with a crafted link or page. Reported by Patchstack and classified CWE-79 with a CVSS 7.1, the scope-changing flaw can lead to session hijacking or defacement in the WordPress context. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a third-party add-on pack that extends the Elementor page builder for WordPress, identified by CPE cpe:2.3:a:element_invader:elementinvader_addons_for_elementor. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically the DOM-based variant: attacker-controllable data reaches a client-side sink (e.g. innerHTML, document.write, or an unsanitized element attribute handled by the plugin's JavaScript) without proper encoding, so the payload executes in the DOM rather than being reflected by the server. Because Elementor add-ons render user-influenced content into pages, tainted parameters processed by the plugin's front-end scripts are the likely injection path.

RemediationAI

No vendor-released patch version is identified in the available data, so treat the fix as pending confirmation and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-4-3-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org changelog for a release newer than 1.4.3, upgrading as soon as one is published. Until then, apply compensating controls: deploy a WAF or Patchstack's virtual patching to filter XSS payloads targeting the plugin, add a strict Content-Security-Policy that disallows inline script execution to blunt DOM injection (note this can break other plugins/themes relying on inline scripts and requires testing), and if the vulnerable feature is non-essential, disable or remove the plugin to eliminate exposure at the cost of losing its Elementor widgets.