The Plus Addons EUVD-2026-89881

Requires an authenticated WordPress account with at least Contributor role (PR:L) on a site running The Plus Addons for Elementor Page Builder Lite version 6.5.1 or earlier. Exploitation also requires user interaction (UI:R): a higher-privileged user must view or render the attacker-injected content for the script to fire. Limiting factors: the plugin must be installed and active, the attacker must already hold a low-privilege editorial account (not open registration on most hardened sites), and the payload only yields impact when a victim renders it - there is no unauthenticated or automatic trigger.

This is a moderate, real-world-low-priority issue. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) is driven primarily by the scope change (S:C) inherent to stored/reflected XSS in a browser context, not by severe raw impact - confidentiality, integrity, and availability are all rated Low. The vector requires an authenticated Contributor-level account (PR:L) plus victim interaction (UI:R), which meaningfully narrows the practical attack surface: an adversary must already possess a low-privilege editorial account on the target WordPress site and must lure a higher-privileged user (e.g., editor/admin) into rendering the malicious content. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the intelligence set, so there is no public exploit identified at time of analysis. This is a typical Patchstack-catalogued contributor-XSS finding - genuine and worth patching, but it is a high-CVSS-relative-to-real-risk case rather than an urgent, mass-exploitable threat. No conflicting signals were found in the data; the CVSS vector is internally consistent with a Contributor XSS.

An attacker who has registered or obtained a Contributor account on a WordPress site running The Plus Addons for Elementor Page Builder Lite <= 6.5.1 injects a malicious script payload into an Elementor widget field or post content that the plugin fails to sanitize. When an administrator or editor later previews or opens that content in wp-admin, the script executes in their authenticated browser session, enabling session hijacking or admin-action forgery. No public PoC is referenced, and success depends on the victim viewing the attacker-controlled content.