What is the CVSS score of EUVD-2026-35996?

EUVD-2026-35996 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

aThemes Addons for Elementor EUVD-2026-35996

| CVE-2026-8613 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 security@wordfence.com

GHSA-796w-m2r4-c726

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 08:30 vuln.today

CVE Published

Jun 10, 2026 - 08:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects the Posts Timeline widget as well as the Posts Carousel widget across its default, Banner, and Modern skins, all of which omit the whitelist validation that is correctly applied in the Posts List widget.

AnalysisAI

Stored Cross-Site Scripting in the aThemes Addons for Elementor WordPress plugin (versions up to and including 1.1.8) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'title_tag' widget setting in the Posts Timeline and Posts Carousel widgets. The injected payload executes in the browsers of any user who subsequently visits the compromised page, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis, though the contributor-level authentication barrier is low in multi-author WordPress deployments.

Technical ContextAI

The vulnerability exists within the aThemes Addons for Elementor Lite plugin, an Elementor page-builder extension for WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the omission of HTML tag whitelist validation on the 'title_tag' widget parameter. Source code references confirm that the affected files are class-posts-carousel.php (line 1413), class-posts-carousel-banner.php (line 226), class-posts-carousel-modern.php (line 208), and class-posts-timeline.php (line 1351) in the 1.1.8 tag. The central sanitization logic in inc/functions.php (line 1375 in 1.1.8, patched at line 1374 in 1.1.9) is correctly applied in the Posts List widget but was not consistently called across the Posts Carousel default, Banner, and Modern skins, nor the Posts Timeline widget. The CVSS Scope:Changed rating reflects that the exploit crosses the security boundary from the WordPress plugin context into the victim's browser session.

RemediationAI

Vendor-released patch: version 1.1.9. WordPress site administrators should update the aThemes Addons for Elementor Lite plugin to version 1.1.9 or later immediately via the WordPress plugin dashboard or by downloading from the WordPress plugin repository. The changeset (https://plugins.trac.wordpress.org/changeset?old_path=/athemes-addons-for-elementor-lite/tags/1.1.8&new_path=/athemes-addons-for-elementor-lite/tags/1.1.9) confirms the fix is limited to sanitization of the title_tag setting in the affected widgets. As a compensating control where immediate patching is not possible, administrators should audit and restrict user roles - demoting untrusted accounts from Contributor to Subscriber eliminates the attack vector, since Subscriber-level users cannot publish or save Elementor widgets. A web application firewall (WAF) rule targeting stored XSS patterns in POST bodies destined at wp-admin/admin-ajax.php can provide secondary mitigation, though WAF bypass is possible with obfuscated payloads. Wordfence users are encouraged to verify their Wordfence rule set is current, as Wordfence reported this vulnerability and likely has coverage.