CVE-2026-11328

MediumCVSS 6.4/10Last modified Jul 7, 2026

Description

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Jul 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1132808.8Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox viCVE-2026-1132818.8Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code iCVE-2026-1132828.8Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inCVE-2026-1132839.6Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execuCVE-2026-1132848.8Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the CVE-2026-1132858.8Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside CVE-2026-1132868.8Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandCVE-2026-1132878.8Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox viaCVE-2026-1132888.8Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox viaCVE-2026-1132898.8Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrCVE-2026-113293.6A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/RunCVE-2026-1132908.8Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the s
CVE-2026-11328: Medium severity, CVSS 6.4 | Vulnix