{"id":"CVE-2026-117521","published":"2026-11-11T06:17:14.240","lastModified":"2026-11-11T06:17:14.240","description":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}