CVE-2026-114184 Overview
CVE-2026-114184 is a stored cross-site scripting (XSS) vulnerability in the WPVibes Elementor Addon Elements plugin for WordPress, tracked as addon-elements-for-elementor-page-builder. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Authenticated contributors can inject JavaScript that persists in the database and executes in the browsers of other users who view the affected page. The issue affects all plugin versions up to and including 1.14.4.
Critical Impact
Authenticated attackers with low-privilege access can store malicious scripts that run in the context of site visitors and administrators, enabling session theft, forced actions, and content tampering.
Affected Products
- WPVibes Elementor Addon Elements plugin (addon-elements-for-elementor-page-builder)
- All versions from n/a through 1.14.4
- WordPress sites running Elementor with this addon installed
Discovery Timeline
- 2026-10-22 - CVE-2026-114184 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114184
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Elementor Addon Elements plugin. The plugin fails to sanitize or escape user-supplied input before rendering it inside page content generated by Elementor widgets. Because the payload persists in the WordPress database, it executes every time a victim loads the affected page.
Exploitation requires an authenticated session with permission to edit Elementor content, which in a default WordPress deployment typically maps to a contributor or higher role. User interaction is also required, since the payload only triggers when another user renders the affected page. The scope change in the CVSS vector reflects script execution in a browser context trusted by the victim.
Successful exploitation can lead to session hijacking, administrative action forgery through the WordPress REST API, phishing overlays, and defacement. Chained with a logged-in administrator visiting the page, the attacker can effectively escalate from contributor to full site takeover.
Root Cause
The root cause is missing output encoding and input validation on one or more widget attributes handled by the plugin. The affected code paths render attacker-controlled values directly into HTML without passing them through WordPress sanitization helpers such as wp_kses_post(), esc_html(), or esc_attr().
Attack Vector
An attacker with contributor-level credentials opens the Elementor editor and inserts a JavaScript payload into a vulnerable widget field provided by Elementor Addon Elements. The payload is saved and later rendered in the DOM when any user previews or publishes the page. See the Patchstack XSS Vulnerability Report for the specific advisory.
Detection Methods for CVE-2026-114184
Indicators of Compromise
- Unexpected <script> tags, event handler attributes (onerror, onload, onclick), or javascript: URIs stored in wp_postmeta rows tied to Elementor data.
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages built with the plugin.
- New administrator accounts, modified user roles, or plugin installations following contributor edits.
Detection Strategies
- Query Elementor post meta for suspicious strings such as <script, onerror=, or onload= across posts containing addon widgets.
- Review WordPress audit logs for contributor accounts editing pages that are later viewed by administrators.
- Inspect Content Security Policy violation reports for inline script executions on pages using Elementor Addon Elements.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to track post revisions and user role changes.
- Forward web server and WordPress logs into a centralized analytics platform to correlate contributor edits with administrator sessions.
- Monitor for anomalous REST API calls originating from authenticated administrator cookies after page views.
How to Mitigate CVE-2026-114184
Immediate Actions Required
- Update the Elementor Addon Elements plugin to a version released after 1.14.4 once the vendor publishes a fix.
- Audit all contributor, author, and editor accounts and remove any that are inactive or unnecessary.
- Review recent Elementor-built pages for unexpected scripts or markup injected by low-privilege users.
Patch Information
At the time of publication, the advisory lists all versions through 1.14.4 as affected. Monitor the Patchstack advisory and the WPVibes plugin changelog for the fixed release and apply it as soon as it is available.
Workarounds
- Temporarily deactivate the Elementor Addon Elements plugin until a patched version is released.
- Restrict Elementor editing capability to trusted administrators and remove it from contributor and author roles.
- Deploy a web application firewall rule to block common XSS payload patterns in POST requests to /wp-admin/admin-ajax.php and Elementor save endpoints.
- Enforce a strict Content Security Policy that disallows inline scripts on the front end to reduce payload impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
