CVE-2026-117522 Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

CVE-2026-117522

The Dynific Addons for Elementor (formerly Anywhere Elementor ) WordPress plugin, in versions before 1.3.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape the post title before outputting it within a quoted HTML attribute in one of its Elementor widget...