CVE-2026-103914— Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter

Quick assessment

Affected

wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Dynific Addons for Elementor"在 1.3 及更早版本中存在 SQL 注入漏洞，该漏洞通过参数触发。其根本原因在于对用户输入参数的转义处理不足，且现有的 SQL 查询在 AJAX 处理程序及其中的回调函数中缺乏充分的预处理。具体而言，该值会经过处理（对、和使用进行转义），随后被拼接到一个单引号包裹的 SQL 字面量中。然而，这种构造方式无法转义单引号，反而会主动转义由在攻击者输入的单引号前添加的反斜杠，从而使得该单引号能够提前终止字面量。因此，拥

CVSS 6.5 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190.001

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ae_preview_post() AJAX handler and its preview_post_filter() posts_where callback, where the value is passed through $wpdb->esc_like() (addcslashes for '_%\\') and concatenated into a single-quoted SQL LIKE literal — a construction that does not escape single quotes and actively escapes the backslash wp_magic_quotes places before the attacker's quote, freeing it to terminate the literal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wpvibes	Dynific Addons for Elementor (formerly Anywhere Elementor)	0 ~ 1.3	-

II. Public POCs for CVE-2026-103914

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-103914

请登录查看更多情报信息。

Other References for CVE-2026-103914 (6)

https://www.cve.org/CVERecord?id=CVE-2026-103914

Same Patch Batch · wpvibes · 2026-11-07 · 4 CVEs total

CVE-2026-102564	6.5 MEDIUM	Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbi
CVE-2026-119467	5.4 MEDIUM	WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability
CVE-2026-119465	5.3 MEDIUM	WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability

IV. Related Vulnerabilities

Same product: Dynific Addons for Elementor (formerly Anywhere Elementor)

Same vendor: wpvibes

Same weakness: CWE-89