CVE-2026-57376

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The ElementInvader Addons for Elementor WordPress plugin contains a DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw arises from improper input neutralization during web page generation, allowing an attacker to inject malicious JavaScript code.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.

Recommendation

Immediately update the ElementInvader Addons for Elementor plugin to a version higher than 1.4.3, which includes a fix for this vulnerability.

Other vulnerabilities in ElementInvader Addons for Elementor

CVE-2025-10873Medium
The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated users to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS