CVE-2026-96829 - WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

MEDIUM

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

Published Sep 30, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.18%

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

Vendor Posimyth Product The Plus Addons for Elementor Page Builder Lite Default
unaffected
Affected
- ≤ 6.5.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Posimyth	The Plus Addons for Elementor Page Builder Lite	unaffected	Affected ≤ 6.5.1

Vendor solution

Update the WordPress The Plus Addons for Elementor Page Builder Lite plugin to the latest available version (at least 6.5.2).

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89881		Advisory
https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-6-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve		vdb-entry

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Patchstack

Published Sep 30, 2026

Updated Sep 30, 2026

Reserved Sep 23, 2026

CISA Vulnrichment

Updated Sep 30, 2026

NVD

Status Deferred

Modified Sep 30, 2026

Red Hat

No data

ENISA EUVD

Assigner Patchstack

Published Sep 30, 2026

Updated Sep 30, 2026

GitHub

No data