Executive brief
Exclusive Addons for Elementor is a popular WordPress plugin that extends the Elementor page builder with additional content widgets. The plugin fails to properly validate and sanitize user input in the infobox image parameter, allowing authenticated users with Contributor privileges or higher to inject malicious scripts into pages. When other users visit affected pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive data.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'exad_infobox_image' parameter of the Exclusive Addons for Elementor plugin. The root cause is insufficient input sanitization and output escaping in the infobox element handler. An authenticated attacker with Contributor-level access or above can inject arbitrary JavaScript code via the vulnerable parameter; when the page is rendered, the malicious script executes in the context of any user viewing that page. The flaw affects all versions up to and including 2.7.9.8. A patch should be available in a later version.
Affected products
- WPSmart Exclusive Addons for Elementor up to and including 2.7.9.8
Timeline
- 2026-08-02: disclosed