CVE-2026-117522
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting.