# CVE-2026-116848: POSIMYTH The Plus Addons for Elementor stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-116848-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-116848 · Severity: medium · CVSS 6.5 · Published 2026-10-29

The Plus Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional functionality. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor or developer privileges to inject malicious scripts into web pages, which are then executed when other users visit those pages, potentially stealing visitor data or hijacking their accounts.

Vendors: [POSIMYTH Innovations](https://junglewise.ai/threats/vendors/posimyth-innovations).

## Quick answers

**Is CVE-2026-116848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116848 being exploited in the wild.

**How severe is CVE-2026-116848?** Medium severity, with a CVSS score of 6.5, published 29 October 2026.

**Which products and versions are affected?** POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite through 6.5.3.

**Is there a fix for CVE-2026-116848?** Yes: fixed in 6.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116848 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116848?** Check whether you run POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.6.0

## Technical details

The vulnerability is an improper neutralization of user input during web page generation, allowing stored XSS injection via the plugin's interface. Attack requires contributor-level or higher privileges on the WordPress site. Once injected, malicious scripts execute in the browsers of all visitors viewing the compromised content, enabling session hijacking, credential theft, and malware distribution.

## Affected products

- POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite through 6.5.3

## Timeline

- 2026-10-29: disclosed
- 2026-10-29: patched

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-6-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-6-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [The Plus Addons for Elementor Page Builder Lite cross-site scripting](https://junglewise.ai/threats/cve-2026-96829-contributor-cross-site-scripting-xss-in-the-plus-addons-for)