# CVE-2026-117521: Dynific Addons for Elementor unescaped profile value in Post Author widget

Source: https://junglewise.ai/threats/cve-2026-117521-the-dynific-addons-for-elementor-formerly-anywhere-elementor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-117521 · Severity: info · Published 2026-11-11

Dynific Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets. The plugin fails to sanitize user profile data before displaying it in a Post Author widget, allowing authors to inject malicious code that executes when administrators or other users view their posts, potentially leading to account compromise or data theft.

Technologies: [Dynific Addons for Elementor](https://junglewise.ai/threats/technologies/dynific-addons-for-elementor). Vendors: [Dynific](https://junglewise.ai/threats/vendors/dynific).

## Quick answers

**Is CVE-2026-117521 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117521 being exploited in the wild.

**How severe is CVE-2026-117521?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Dynific Addons for Elementor before 1.3.1.

**Is there a fix for CVE-2026-117521?** Yes: fixed in 1.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117521 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-117521?** Check whether you run Dynific Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.3.1

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Post Author widget where user-controlled profile values are output directly into quoted HTML attributes without proper escaping. An authenticated user with Author role can craft a malicious display name and store it in their profile; the payload executes in the browser of any user viewing a post authored by the attacker, including administrators. A fix is available in version 1.3.1.

## Affected products

- Dynific Addons for Elementor before 1.3.1

## Timeline

- 2026-11-09: disclosed
- 2026-11-11: advisory

## References

- [https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/](https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/)

## Related threats

- [Dynific Addons for Elementor information disclosure via shortcode](https://junglewise.ai/threats/cve-2026-117524-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor privilege escalation in AJAX module settings](https://junglewise.ai/threats/cve-2026-117523-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor stored XSS in post title via widget](https://junglewise.ai/threats/cve-2026-117522-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor SQL injection in preview handler](https://junglewise.ai/threats/cve-2026-103914-the-dynific-addons-for-elementor-plugin-for-wordpress-is)
- [Dynific Addons for Elementor arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-102564-the-the-dynific-addons-for-elementor-formerly-anywhere-elementor)