The vulnerability CVE-2026-22518 affects pencilwp's X Addons for Elementor plugin, specifically versions up to 1.0.23. It is a DOM-based cross-site scripting issue caused by improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, indicating medium severity, with an attack vector of network, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the victim's browser context, potentially leading to partial confidentiality, integrity, and availability impacts within the affected application environment. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting user privileges and educating users about the risks of interacting with untrusted content. Monitor official pencilwp channels for updates regarding patches or mitigations.