CVE-2026-57376 describes a DOM-based Cross-site Scripting vulnerability in ElementInvader Addons for Elementor. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to inject and execute malicious scripts within the victim's browser context. This affects versions up to and including 1.4.3. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of users visiting affected web pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data and sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying workarounds such as disabling or restricting the vulnerable addon, or implementing web application firewall (WAF) rules to detect and block malicious input patterns related to DOM-based XSS.