CVE-2026-96829

MediumCVSS 6.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Cross Site Scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite up to version 6.5.1. A user with Contributor role can inject malicious script.

Risk Assessment

An attacker can steal user sessions or take over accounts, leading to data integrity compromise.

Recommendation

Update the plugin to the latest version that includes the fix.

Other vulnerabilities in The Plus Addons for Elementor Page Builder Lite

CVE-2026-116848Medium
The Plus Addons for Elementor Page Builder Lite in versions up to 6.5.3 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to store a malicious script that executes in a user's browser.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS