CVE-2026-115950
MediumCVSS 6.5Summary
The Better Post & Filter Widgets for Elementor plugin through version 1.9.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
Risk Assessment
A malicious script stored on the site could execute in users' browsers, enabling session theft or administrator account takeover.
Recommendation
Update the Better Post & Filter Widgets for Elementor plugin to a version later than 1.9.1.
Other vulnerabilities in Better Post & Filter Widgets for Elementor
See all- CVE-2026-115949Medium
The Better Post & Filter Widgets for Elementor plugin (up to version 1.9.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated users to perform actions they should not have access to.
- CVE-2025-48354Medium
The Better Post & Filter Widgets for Elementor plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Better Post & Filter Widgets for Elementor versions from n/a through 1.6.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS