What is the CVSS score of CVE-2026-57376?

CVE-2026-57376 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of ElementInvader Addons are affected by CVE-2026-57376?

The ElementInvader Addons for Elementor WordPress plugin (versions through 1.4.3) contains a DOM-based cross-site scripting vulnerability enabling attackers to inject malicious scripts into user…

How to fix or mitigate CVE-2026-57376?

Within 24 hours, conduct a complete inventory of WordPress installations to identify all systems running ElementInvader Addons for Elementor and notify affected teams of the exposure. Within 7 days, disable the ElementInvader Addons for Elementor plugin across all affected WordPress installations until a vendor-released patch becomes available; if operational requirements prevent disablement, implement strict content security policies (CSP) with script-src restrictions to block injected scripts, and validate the remediation through automated WordPress security scanning. Within 30 days, monitor Patchstack security advisories and Elementor's release channels weekly for a vendor patch; once available, immediately deploy version 1.4.4 or later across all installations and conduct a follow-up WordPress plugin security audit to identify similar XSS vulnerabilities in other extensions.

ElementInvader Addons CVE-2026-57376

EUVD-2026-43444 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS Elementinvader Addons For Elementor

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered DOM XSS needs victim interaction (UI:R) and no attacker auth (PR:N); script crosses into the site context (S:C) with low confidentiality/integrity impact and no real availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:06 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.3.

AnalysisAI

DOM-based cross-site scripting in the ElementInvader Addons for Elementor WordPress plugin (all versions up to and including 1.4.3) lets remote attackers inject client-side script that executes in a victim's browser when they interact with a crafted link or page. Reported by Patchstack and classified CWE-79 with a CVSS 7.1, the scope-changing flaw can lead to session hijacking or defacement in the WordPress context. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious URL with XSS payload

Delivery

Lure victim to click/load page

Exploit

Payload reaches DOM sink in plugin JS

Execution

Script executes in site origin

Impact

Hijack session or perform actions as victim