CVE-2026-114185
MediumCVSS 6.5Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS. This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Risk Assessment
An attacker can inject a malicious script that executes in the browser of a user visiting the site, potentially leading to session or data theft. This can harm users and the site's reputation.
Recommendation
Update the AnyWhere Elementor plugin to a version higher than 1.3.0. Until updated, consider restricting content creation capabilities for low-privileged users.
Other vulnerabilities in AnyWhere Elementor
See all- CVE-2026-114187Medium
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AnyWhere Elementor: from n/a through 1.3.0.
- CVE-2026-114183Medium
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data. This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS