CVE-2026-11328

MediumCVSS 6.4/10Last modified Jul 7, 2026

Description

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Jul 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1132808.8Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via aCVE-2026-1132818.8Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prCVE-2026-1132828.8Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processCVE-2026-1132839.6Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to executCVE-2026-1132848.8Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cCVE-2026-1132858.8Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sCVE-2026-1132868.8Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procCVE-2026-1132878.8Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypassCVE-2026-1132888.8Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive iCVE-2026-1132898.8Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data viaCVE-2026-113293.6A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/RunCVE-2026-1132908.8Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
CVE-2026-11328: Medium severity, CVSS 6.4 | Vulnix