What is the CVSS score of EUVD-2026-41782?

EUVD-2026-41782 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Exclusive Addons Elementor EUVD-2026-41782

| CVE-2026-59511 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-05 Patchstack

GHSA-w5x6-33vr-7xmp

WordPress Information Disclosure Wordpress Plugin Exclusive Addons Elementor Tim Strifler

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible WordPress plugin endpoint leaks data to unauthenticated requesters; no integrity or availability impact applies per CWE-201 data-exposure class.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 22:16 vuln.today

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data.

This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9.

AnalysisAI

Sensitive data exposure in Exclusive Addons Elementor (WordPress plugin by Tim Strifler) through version 2.7.9.9 enables unauthenticated remote attackers to retrieve sensitive information embedded within HTTP responses. The CWE-201 root cause indicates the plugin incorrectly includes sensitive data in outbound responses accessible to any network client without authentication, as confirmed by the CVSS vector (PR:N/UI:N). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the network-accessible, zero-prerequisite attack surface warrants prompt patching on internet-facing WordPress installations.

Technical ContextAI

The affected component is the Exclusive Addons for Elementor WordPress plugin (CPE: cpe:2.3:a:tim_strifler:exclusive_addons_elementor:*:*:*:*:*:*:*:*), a third-party addon extending the Elementor page-builder framework. CWE-201 (Insertion of Sensitive Information Into Sent Data) describes a pattern where a software component unnecessarily includes sensitive data - such as API keys, user metadata, internal configuration, or credentials - within data transmitted to a requesting party. In WordPress plugin contexts this typically manifests as sensitive values being serialized into page HTML, REST API responses, or AJAX endpoints that are accessible without authentication. The vulnerability class differs from information leakage in logs (CWE-532) or error messages (CWE-209) in that the data is intentionally sent but to an overly broad audience.

RemediationAI

Update Exclusive Addons for Elementor to a version beyond 2.7.9.9 via the WordPress plugin dashboard or by downloading the patched release from the WordPress.org plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/exclusive-addons-for-elementor/vulnerability/wordpress-exclusive-addons-elementor-plugin-2-7-9-9-sensitive-data-exposure-vulnerability should be consulted for the confirmed fixed version, as an exact patched version number was not independently confirmed in the available input data. If an immediate update is not feasible, a compensating control is to restrict unauthenticated access to WordPress AJAX endpoints and REST API routes at the web server or WAF layer - note this may break frontend functionality for non-logged-in users and should be tested. Additionally, auditing what sensitive data the plugin may have already exposed (e.g., reviewing logs for suspicious enumeration of plugin endpoints) is advisable post-discovery.