Exclusive Addons for Elementor Authenticated Stored XSS via exad_infobox_image

Vulnerability Overview Vulnerability Name: Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image' CVE ID: CVE-2026-12231 CVSS Score: 6.4 (Medium) Publication Date: August 1, 2026 Last Update Date: August 2, 2026 Researchers: Dmitrii Ignatyev - CleanTalk Inc Affected Scope Software Type: Plugin Software Name: Exclusive Addons for Elementor Affected Versions: <= 2.7.9.8 Fixed Versions: 2.7.9 Remediation Recommendation: Update to version 2.7.9 or newer patched versions Vulnerability Description The Exclusive Addons for Elementor plugin contains a stored Cross-Site Scripting (XSS) vulnerability, allowing attackers to inject malicious scripts that execute when users access the affected page. References plugins.trac.wordpress.org Related Recent Vulnerabilities CVE-2026-66438: Exclusive Addons Elementor <= 2.8.0 - Unauthenticated Information Exposure CVE-2026-11328: Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title CVE-2026-59511: Exclusive Addons for Elementor <= 2.7.9.9 - Unauthenticated Information Exposure CVE-2026-57620: Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-7498: Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown CVE-2025-4783: Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget CVE-2025-48244: Exclusive Addons Elementor <= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-1571: Exclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets CVE-2024-10312: Exclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates CVE-2024-49292: Exclusive Addons Elementor <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Additional Information Wordfence Intelligence: Provides free personal and commercial API access to the latest WordPress vulnerability database. Wordfence Plugin: Can be installed on WordPress sites to notify users promptly of any new vulnerabilities affecting their websites. Contact Information Technical Support: wfi-support@wordfence.com Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, year-round, 1-hour response time Legal Disclaimer Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the license terms of MITRE and Defiant Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Subscription Subscription Form: Enter email address to subscribe to news and updates Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe for Updates Subscription Form: Enter email address to subscribe to news and updates Copyright Notice © 2012-2026 Defiant Inc. All Rights Reserved Additional Information Wordfence Intelligence: Provides free personal and commercial API access to the latest WordPress vulnerability database. Wordfence Plugin: Can be installed on WordPress sites to notify users promptly of any new vulnerabilities affecting their websites. Contact Information Technical Support: wfi-support@wordfence.com Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, year-round, 1-hour response time Legal Disclaimer Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the license terms of MITRE and Defiant Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Subscription Subscription Form: Enter email address to subscribe to news and updates Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Secu

Goal Reached Thanks to every supporter — we hit 100%!

Exclusive Addons for Elementor Authenticated Stored XSS via exad_infobox_image

More from this source