CVE-2026-11328 is a stored cross-site scripting vulnerability in the Exclusive Addons for Elementor WordPress plugin. The flaw exists in all versions up to and including 2.7.9.8, where the post title parameter is not properly sanitized or escaped. This allows authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into page titles. When other users view these pages, the scripts execute in their browsers, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of the victim. The vulnerability does not impact availability but affects confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider implementing additional input validation or output encoding controls at the application or web server level to mitigate exploitation.