Addon Elements for Elementor: Stored Cross-Site Scripting
Summary
The WordPress plugin Addon Elements for Elementor (also listed as Elementor Addon Elements) is affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-125743, CWE-79). An authenticated user with low privileges, such as a contributor, can store malicious scripts that run in the browser of other visitors when a privileged user performs an action, for example by opening a crafted page. Successful exploitation could allow visitor data theft or account hijacking. The CVE record states that versions up to 1.5 are affected, but this range is unverified and conflicts with the current plugin version history.
Affected
- Addon Elements for Elementor (Elementor Addon Elements) per CVE record and Patchstack: versions up to and including 1.5 (range unverified, see notes)
- Other records indicate that the plugin is far beyond 1.5, so the affected range may be a CNA data error.
Fixed in
- Patchstack and the CVE record list 1.5.1 as the patched version. This is not verified against the vendor changelog.
- Unknown: no vendor advisory or changelog entry for this CVE was found.
Workaround
- Unknown. No patch-independent workaround is documented in the sources.
- If no fixed release can be confirmed, deactivate the plugin or restrict which users can create or edit Elementor content.
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- No public proof of concept found; status unknown.
- Attack requires an authenticated low-privilege account (PR:L) and user interaction (UI:R).
Our recommendation
- Inventory the plugin version on all WordPress sites in scope and check the WordPress.org changelog for this CVE.
- Update to the newest available release of the plugin.
- If no fixed version can be confirmed, consider removing the plugin where it is not essential.
- Review and remove unused contributor-level or author accounts.
- Re-check NVD, Patchstack and CISA KEV for status changes, as the NVD record is still Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory (linked by the CVE) patchstack.com
- OffSeq Radar: CVE-2026-125743 radar.offseq.com
- Strix: CVE-2026-125743 www.strix.ai
- WPVibes WordPress.org profile profiles.wordpress.org
- WPVibes website wpvibes.com
- WPBeacon plugin page wpbeacon.io
- Related CVE: CVE-2026-119465 vulners.com
- Related Patchstack advisory: 1.13.5 contributor stored XSS patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:24.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.