# CVE-2026-11328: Exclusive Addons Exclusive Addons for Elementor Stored XSS in post title

Source: https://junglewise.ai/threats/cve-2026-11328-exclusive-addons-exclusive-addons-for-elementor-stored-xss-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-11328 · Severity: medium · CVSS 6.4 · Published 2026-07-07

Exclusive Addons for Elementor is a popular WordPress plugin used to enhance website design. A security flaw allows users with basic contributor permissions to inject malicious scripts into page titles. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.

## Quick answers

**Is CVE-2026-11328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11328 being exploited in the wild.

**How severe is CVE-2026-11328?** Medium severity, with a CVSS score of 6.4, published 7 July 2026.

**Which products and versions are affected?** Exclusive Addons Exclusive Addons for Elementor up to, and including, 2.7.9.8.

**Is there a fix for CVE-2026-11328?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11328 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11328?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the post title parameter. This vulnerability exists in all versions up to and including 2.7.9.8. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts are stored on the server and execute in the context of a user's browser whenever they access the compromised page. The flaw is specifically located within the post-duplicator extension of the plugin.

## Affected products

- Exclusive Addons Exclusive Addons for Elementor up to, and including, 2.7.9.8

## Timeline

- 2026-07-07: disclosed
- 2026-07-07: advisory

## References

- [https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/extensions/post-duplicator.php](https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/extensions/post-duplicator.php)
- [https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/extensions/post-duplicator.php](https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.8/extensions/post-duplicator.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/690fd38c-0e12-45f3-9055-51252e4809b1?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/690fd38c-0e12-45f3-9055-51252e4809b1?source=cve)