CVE-2026-114184 WPVibes CVE debrief

Who should care

Defenders responsible for WordPress installations with the Elementor Addon Elements plugin should assess exposure and prioritize updates to mitigate this vulnerability. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also verify if their installations are affected and plan vendor-supported updates or mitigations through normal change control where exposure is

Why it matters

CVE-2026-114184 is a medium-severity vulnerability in the WordPress Elementor Addon Elements plugin, allowing for Stored XSS attacks. Defenders should prioritize updates to mitigate this risk.

• Attackers may inject malicious scripts into web pages, potentially leading to unauthorized actions or data theft
• Successful exploitation could result in compromised user sessions or website defacement
• Defenders must verify if their installations are affected and prioritize updates to version 1.14.5 or later
• Remediation requires updating the plugin, and compensating controls like CSP may be necessary

Technical summary

The Elementor Addon Elements plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.14.4. The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data theft. Defenders should prioritize updating the Elementor Addon Elements plugin to version 1.14.5 or later to mitigate this vulnerability. Additionally, defenders should review and monitor web application logs for suspicious activity and implement Content Security Policy (CSP) to reduce XSS risk.

Defensive priority

Defenders should prioritize updating the Elementor Addon Elements plugin to version 1.14.5 or later to mitigate this vulnerability.

Recommended defensive actions

• Update Elementor Addon Elements plugin to version 1.14.5 or later
• Review and monitor web application logs for suspicious activity
• Implement Content Security Policy (CSP) to reduce XSS risk
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about this vulnerability. The source item from cve_program_cvelist_v5 offers additional context. Defenders should verify if their installations are affected and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.