Dynific Addons for Elementor: Stored XSS via post title in Author role
Summary
The WordPress plugin Dynific Addons for Elementor (formerly Anywhere Elementor) before version 1.3.1 does not escape the post title in one of its Elementor widgets, which the advisory links to the Post Image Widget. An authenticated user with the Author role can publish a post whose title runs script when viewed. If an administrator views the post, the script runs in the administrator's session, so the attack can lead to a full site compromise. The attacker needs an Author account, and a victim has to view the post.
Affected
- Dynific Addons for Elementor (formerly Anywhere Elementor) versions before 1.3.1
- Vulnerable range according to the CNA record: 0 to before 1.3.1
Fixed in
- Version 1.3.1
Workaround
- No vendor workaround known.
- Until the update: review which accounts hold the Author role and remove unneeded accounts.
- Review recently published posts by Authors, especially titles containing HTML or script code.
- Restrict who can publish posts.
Exploitation
- Not known to be exploited.
- Not listed in CISA's Known Exploited Vulnerabilities catalogue.
- No public exploit code found in the indexes checked (Metasploit, Exploit-DB).
Our recommendation
- Update Dynific Addons for Elementor to version 1.3.1 in the normal update cycle.
- Treat the update as urgent if Author accounts are held by external or untrusted users, or if self-registration is open.
- Check which WordPress sites use the plugin and which accounts have the Author role.
- Review existing posts for suspicious titles and monitor for unexpected script activity in the admin area.
- The CVSS score 6.8 is not confirmed; NVD scoring was pending at the time of research.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory CVE-2026-117522 wpscan.com
- CVE Record CVE-2026-117522 www.cve.org
- VulDB CVE-2026-117522 vuldb.com
- OffSeq Radar CVE-2026-117522 radar.offseq.com
- OpenCVE CVE-2026-117522 app.opencve.io
- Strix CVE-2026-117522 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:35.
Original description (NVD)
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.