CVE-2026-114184: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WPVibes Elementor Addon Elements

This vulnerability in WPVibes Elementor Addon Elements (addon-elements-for-elementor-page-builder) allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions from initial release through 1.14.4. An attacker with low privileges and requiring user interaction could exploit this to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability of affected systems. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, user interaction required, and scope change with partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of content, or disruption of service. The vulnerability requires low privileges and user interaction, and it affects confidentiality, integrity, and availability to a limited extent.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting plugin usage or applying web application firewall rules to detect and block XSS payloads relevant to this plugin.