The Plus Addons For Elementor Page Builder Lite
Monthly
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite (versions through 6.5.3) lets an authenticated low-privilege user place script-bearing content that executes when another user views the affected page. The flaw is CWE-79 and is assessed at CVSS 6.5 with network reach, low privileges, and required victim interaction; no public exploit was identified at time of analysis and there is no CISA KEV entry. The specific vulnerable input field or plugin feature is not identified in the available sources.
Cross-site scripting in The Plus Addons for Elementor Page Builder Lite (versions up to and including 6.5.1) lets an authenticated user holding Contributor-level access on a WordPress site inject script that executes when a higher-privileged user views the affected content. Exploitation is not automatic: it requires the victim to render the injected content (UI:R), so the practical impact is script execution in the victim's browser session - session or token theft, content manipulation, or actions taken as the victim - rather than direct server compromise. Scoring CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), this is a moderate, real-world-low-priority issue, and no public exploit code or confirmed active exploitation (not listed in CISA KEV) was identified at time of analysis.
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite (versions through 6.5.3) lets an authenticated low-privilege user place script-bearing content that executes when another user views the affected page. The flaw is CWE-79 and is assessed at CVSS 6.5 with network reach, low privileges, and required victim interaction; no public exploit was identified at time of analysis and there is no CISA KEV entry. The specific vulnerable input field or plugin feature is not identified in the available sources.
Cross-site scripting in The Plus Addons for Elementor Page Builder Lite (versions up to and including 6.5.1) lets an authenticated user holding Contributor-level access on a WordPress site inject script that executes when a higher-privileged user views the affected content. Exploitation is not automatic: it requires the victim to render the injected content (UI:R), so the practical impact is script execution in the victim's browser session - session or token theft, content manipulation, or actions taken as the victim - rather than direct server compromise. Scoring CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), this is a moderate, real-world-low-priority issue, and no public exploit code or confirmed active exploitation (not listed in CISA KEV) was identified at time of analysis.
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.