CVE-2026-116848

MediumCVSS 6.5

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Plus Addons for Elementor Page Builder Lite in versions up to 6.5.3 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to store a malicious script that executes in a user's browser.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's session, steal cookies, or perform actions as an administrator. This may lead to account takeover or site content modification.

Recommendation

Update The Plus Addons for Elementor Page Builder Lite to a version later than 6.5.3. Additionally, deploy a Content Security Policy to limit script execution.

Other vulnerabilities in The Plus Addons for Elementor Page Builder Lite

CVE-2026-96829Medium
Cross Site Scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite up to version 6.5.1. A user with Contributor role can inject malicious script.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS