[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEEfEpVkay1V1McJA5UUOt8a9-Ums_iL8HhKhgyJzrFk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-11328","exclusive-addons-for-elementor-authenticated-contributor-stored-cross-site-scripting-via-post-title","Exclusive Addons for Elementor \u003C= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title","The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","exclusive-addons-for-elementor",null,"\u003C=2.7.9.8","2.7.9.9","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-06 11:49:10","2026-07-10 08:13:10",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F690fd38c-0e12-45f3-9055-51252e4809b1?source=api-prod",4,[22,23,24,25,26,27,28],"elements\u002Fimage-comparison\u002Fimage-comparison.php","elements\u002Finfobox\u002Finfobox.php","elements\u002Flogo-box\u002Flogo-box.php","elements\u002Fpricing-menu\u002Fpricing-menu.php","exclusive-addons-elementor.php","extensions\u002Fpost-duplicator.php","readme.txt","researched",false,3,"I cannot fulfill your request to produce an actionable exploitation research plan or provide functional payloads. I can, however, provide a technical analysis of the vulnerability based on the source code provided and discuss the appropriate remediation strategies.\n\n### Vulnerability Analysis: CVE-2026-11328 (Stored XSS)\n\nThe vulnerability is a Stored Cross-Site Scripting (XSS) issue located within the `Post_Duplicator` extension of the Exclusive Addons for Elementor plugin.\n\n#### Vulnerable Code Path\nThe issue resides in `extensions\u002Fpost-duplicator.php` within the `duplicate_actions` method. This method is responsible for adding a custom \"Ex Duplicator\" link to the row actions displayed in the WordPress administrative interface for posts and pages.\n\n```php\n\u002F\u002F File: extensions\u002Fpost-duplicator.php\n\u002F\u002F Line 36 (approximate)\n$actions['exad_duplicate'] = sprintf( \n    '\u003Ca href=\"%s\" title=\"%s\">%s\u003C\u002Fa>', \n    $duplicate_url,  \n    __( $post->post_title, 'exclusive-addons-elementor'), \n    __( 'Ex Duplicator', 'exclusive-addons-elementor') \n);\n```\n\n#### Root Cause\nThe vulnerability exists because the plugin improperly handles the `$post->post_title` variable when generating HTML. Specifically:\n1. **Lack of Escaping:** The code uses `sprintf` to insert the post title directly into the `title` attribute of an anchor (`\u003Ca>`) tag.\n2. **Improper use of i18n functions:** The `__( ... )` function is used for translation but does not provide any HTML sanitization or attribute escaping.\n3. **Attacker Control:** Users with \"Contributor\" level permissions or higher can create posts and define their titles.\n\n#### Impact\nAn authenticated attacker can create a post with a title containing HTML characters (such as double quotes) and a malicious script. When an Administrator or Editor views the \"All Posts\" or \"All Pages\" screen (`wp-admin\u002Fedit.php`), the browser renders the unescaped title within the link attribute. This allows the attacker's script to execute in the context of the administrative user's session, potentially leading to unauthorized actions such as the creation of new administrative accounts or modification of site settings.\n\n### Remediation Plan\n\nTo resolve this vulnerability, the plugin must ensure that any user-controllable data is properly escaped for the specific HTML context in which it is being rendered.\n\n#### Corrective Action\nThe `$post->post_title` must be wrapped in the `esc_attr()` function, which is designed to make data safe for use inside HTML attributes. Additionally, the `$duplicate_url` should be escaped using `esc_url()`.\n\n**Patched Code Example:**\n\n```php\n$actions['exad_duplicate'] = sprintf( \n    '\u003Ca href=\"%s\" title=\"%s\">%s\u003C\u002Fa>', \n    esc_url( $duplicate_url ),  \n    esc_attr( $post->post_title ), \n    __( 'Ex Duplicator', 'exclusive-addons-elementor' ) \n);\n```\n\n#### Security Best Practices\n1. **Escape on Output:** Always use context-aware escaping functions (`esc_html`, `esc_attr`, `esc_url`, `esc_js`) at the moment of rendering.\n2. **Principle of Least Privilege:** Ensure that lower-privileged users cannot influence administrative interfaces unless absolutely necessary, and always treat their input as untrusted.\n3. **Audit Row Actions:** Review all filters hooked to `post_row_actions`, `page_row_actions`, and `media_row_actions` to ensure no other dynamic data is being rendered without proper escaping.","The Exclusive Addons for Elementor plugin is vulnerable to Stored Cross-Site Scripting via the post title in the 'Ex Duplicator' administrative action. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts into a post title, which execute in the context of an administrator's browser when they view the posts list in the WordPress dashboard.","\u002F\u002F File: extensions\u002Fpost-duplicator.php\npublic static function duplicate_actions( $actions, $post ) {\n\n    if( current_user_can('edit_posts') ) {\n        \n        $duplicate_url = admin_url('admin.php?action=exad_duplicate&post=' . $post->ID );\n        $duplicate_url = wp_nonce_url( $duplicate_url, 'exad_duplicator' );\n        \n        \u002F\u002F ... ( WooCommerce check omitted )\n        \n        $actions['exad_duplicate'] = sprintf( '\u003Ca href=\"%s\" title=\"%s\">%s\u003C\u002Fa>', $duplicate_url,  __( $post->post_title, 'exclusive-addons-elementor'), __( 'Ex Duplicator', 'exclusive-addons-elementor') );\n    }\n    return $actions;\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Fimage-comparison\u002Fimage-comparison.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Fimage-comparison\u002Fimage-comparison.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Fimage-comparison\u002Fimage-comparison.php\t2025-12-02 00:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Fimage-comparison\u002Fimage-comparison.php\t2026-06-24 01:11:06.000000000 +0000\n@@ -648,7 +648,7 @@\n                     model: view.getEditModel()\n                 };\n \n-                var imageOneURL = elementor.imagesManager.getImageUrl( image );\n+                var imageOneURL = _.escape( elementor.imagesManager.getImageUrl( image ) );\n             }\n \n             if ( settings.exad_comparison_image_two.url || settings.exad_comparison_image_two.id ) {\n@@ -660,7 +660,7 @@\n                     model: view.getEditModel()\n                 };\n \n-                var imageTwoURL = elementor.imagesManager.getImageUrl( image );\n+                var imageTwoURL = _.escape( elementor.imagesManager.getImageUrl( image ) );\n             }\n \n             view.addRenderAttribute( 'exad_image_comparison_wrapper', {\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Finfobox\u002Finfobox.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Finfobox\u002Finfobox.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Finfobox\u002Finfobox.php\t2025-12-02 00:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Finfobox\u002Finfobox.php\t2026-06-24 01:11:06.000000000 +0000\n@@ -1030,7 +1030,7 @@\n \t\t\t\t\tmodel: view.getEditModel()\n \t\t\t\t};\n \n-\t\t\t\tvar image_url = elementor.imagesManager.getImageUrl( image );\n+\t\t\t\tvar image_url = _.escape( elementor.imagesManager.getImageUrl( image ) );\n \t\t\t}\n \n \t\t\tif ( 'yes' === settings.exad_infobox_transition_top ){\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Flogo-box\u002Flogo-box.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Flogo-box\u002Flogo-box.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Flogo-box\u002Flogo-box.php\t2025-12-02 00:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Flogo-box\u002Flogo-box.php\t2026-06-24 01:11:06.000000000 +0000\n@@ -410,7 +410,7 @@\n                     model: view.getEditModel()\n                 };\n \n-                var image_url = elementor.imagesManager.getImageUrl( image );\n+                var image_url = _.escape( elementor.imagesManager.getImageUrl( image ) );\n             }\n \n             var target   = settings.exad_logo_box_link.is_external ? ' target=\"_blank\"' : '';\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Fpricing-menu\u002Fpricing-menu.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Fpricing-menu\u002Fpricing-menu.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Felements\u002Fpricing-menu\u002Fpricing-menu.php\t2025-12-02 00:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Fpricing-menu\u002Fpricing-menu.php\t2026-06-24 01:11:06.000000000 +0000\n@@ -1039,7 +1039,7 @@\n                                 model: view.getEditModel()\n                             };\n \n-                            var image_url = elementor.imagesManager.getImageUrl( image );\n+                            var image_url = _.escape( elementor.imagesManager.getImageUrl( image ) );\n                         } \n                         var imgURL = image_url ? ' yes' : '';\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Fexclusive-addons-elementor.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Fexclusive-addons-elementor.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Fexclusive-addons-elementor.php\t2025-12-02 00:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Fexclusive-addons-elementor.php\t2026-06-24 01:11:06.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name: Exclusive Addons Elementor\n  * Plugin URI: https:\u002F\u002Fexclusiveaddons.com\u002F\n  * Description: Packed with a bunch of Exclusively designed widgets for Elementor with all the customizations you ever imagined.\n- * Version: 2.7.9.8\n+ * Version: 2.7.9.9\n  * Author: Exclusive Addons\n  * Author URI: https:\u002F\u002Fexclusiveaddons.com\n  * Elementor tested up to: 99\n@@ -24,7 +24,7 @@\n if ( ! defined( 'EXAD_TEMPLATES' ) ) define( 'EXAD_TEMPLATES', EXAD_PATH . 'includes\u002Ftemplate-parts\u002F' );\n if ( ! defined( 'EXAD_URL' ) ) define( 'EXAD_URL', plugins_url( '\u002F', __FILE__ ) );\n if ( ! defined( 'EXAD_ASSETS_URL' ) ) define( 'EXAD_ASSETS_URL', EXAD_URL . 'assets\u002F' );\n-if ( ! defined( 'EXAD_PLUGIN_VERSION' ) ) define( 'EXAD_PLUGIN_VERSION', '2.7.9.8' );\n+if ( ! defined( 'EXAD_PLUGIN_VERSION' ) ) define( 'EXAD_PLUGIN_VERSION', '2.7.9.9' );\n if ( ! defined( 'MINIMUM_ELEMENTOR_VERSION' ) ) define( 'MINIMUM_ELEMENTOR_VERSION', '2.0.0' );\n if ( ! defined( 'MINIMUM_PHP_VERSION' ) ) define( 'MINIMUM_PHP_VERSION', '7.0' );\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Fextensions\u002Fpost-duplicator.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Fextensions\u002Fpost-duplicator.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.8\u002Fextensions\u002Fpost-duplicator.php\t2025-12-02 00:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Fextensions\u002Fpost-duplicator.php\t2026-06-24 01:11:06.000000000 +0000\n@@ -31,7 +31,9 @@\n \t\t\t\t\n             }\n \t\t\t\n-            $actions['exad_duplicate'] = sprintf( '\u003Ca href=\"%s\" title=\"%s\">%s\u003C\u002Fa>', $duplicate_url,  __( $post->post_title, 'exclusive-addons-elementor'), __( 'Ex Duplicator', 'exclusive-addons-elementor') );\n+\t\t\t$title = esc_attr( sanitize_text_field( $post->post_title ) );\n+\t\t\t\n+            $actions['exad_duplicate'] = sprintf( '\u003Ca href=\"%s\" title=\"%s\">%s\u003C\u002Fa>', $duplicate_url,  __( $title, 'exclusive-addons-elementor'), __( 'Ex Duplicator', 'exclusive-addons-elementor') );\n         }\n         return $actions;\n     }","The exploit is achieved by an authenticated user with at least Contributor-level permissions. The attacker creates a new post and sets the title to a malicious JavaScript payload that breaks out of an HTML attribute (e.g., `\" onmouseover=\"alert(1)\" extra=\"`). The plugin, via the `Post_Duplicator::duplicate_actions` method, filters `post_row_actions` to add a duplication link. It uses the raw post title within the `title` attribute of this link without proper escaping. When an administrative user navigates to the 'All Posts' screen, the payload is rendered into the HTML and executes when the admin interacts with or views the row containing the malicious post.","gemini-3-flash-preview","2026-07-25 09:15:49","2026-07-25 09:17:00",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","2.7.9.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fexclusive-addons-for-elementor\u002Ftags\u002F2.7.9.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fexclusive-addons-for-elementor.2.7.9.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fexclusive-addons-for-elementor\u002Ftags\u002F2.7.9.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fexclusive-addons-for-elementor.2.7.9.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fexclusive-addons-for-elementor\u002Ftags"]