CVE-2026-117521 | BDVDB-2026-404779 Detail

Dynific Addons for Elementor (formerly Anywhere Elementor)

Description#

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/

Exploit#

https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/

History#

Version 12026-11-11Record published in the CVE List.