{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3311", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-27T03:21:30.148Z", "datePublished": "2026-04-08T05:28:59.702Z", "dateUpdated": "2026-04-08T17:55:51.767Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:19.440Z"}, "affected": [{"vendor": "posimyththemes", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Progress Bar shortcode in all versions up to, and including, 6.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6367c5fc-f664-4105-a1b7-a93fb0a2392b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3473275/the-plus-addons-for-elementor-page-builder"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-27T03:36:44.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T16:43:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T17:55:09.557087Z", "id": "CVE-2026-3311", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T17:55:51.767Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Progress Bar shortcode in all versions up to, and including, 6.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-3311", "lastModified": "2026-04-27T19:04:22.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-08T06:16:28.807", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3473275/the-plus-addons-for-elementor-page-builder"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6367c5fc-f664-4105-a1b7-a93fb0a2392b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "source": "cna", "vendor": "posimyththemes"}, "product": "the_plus_addons_for_elementor_\u2013_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce", "vendor": "posimyththemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T07:21:24.259599+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to a version newer than 6.4.9 to eliminate the stored XSS flaw.", "If upgrading is not immediately possible, restrict contributor or higher access for users who can edit plugin content or disable the Progress Bar shortcode on all pages.", "As a temporary workaround, modify the plugin code to sanitize or escape attributes used by the Progress Bar shortcode or remove those attributes entirely.", "Monitor site activity for abnormal script execution or user\u2011generated content that may indicate exploitation attempts."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting allowing arbitrary script execution on pages"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin \"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce\" developed by posimyththemes. All releases up to and including version 6.4.9 are impacted; versions newer than 6.4.9 are presumed untainted.", "description_and_impact": "A stored Cross\u2011Site Scripting flaw exists in the Progress Bar shortcode of the plugin, stemming from inadequate sanitization and escaping of user supplied attributes. An attacker with contributor\u2011level or higher authenticated access can inject malicious scripts that run whenever a page containing the shortcode is viewed, potentially compromising site content and user interactions.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity. While the Exploit Prediction Scoring System score is not available and the vulnerability is not listed in the CISA KEV catalog, the requirement for authenticated contributor or higher access indicates that exploitation is likely limited to site administrators or privileged users. The altered scripts could lead to theft of credentials, defacement, or further lateral movement within the site."}}}}, "created": "2026-04-08T19:33:17.847565+00:00", "updated": "2026-04-08T19:43:52.980721+00:00", "vendors": ["posimyththemes", "posimyththemes$PRODUCT$the_plus_addons_for_elementor_\u2013_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}