Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Progress Bar shortcode in all versions up to, and including, 6.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-3311 The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Script… https://www.cve.org/CVERecord?id=CVE-2026-3311
Post summary
The post announces CVE-2026-3311 as a stored XSS vulnerability affecting the Plus Addons for Elementor plugin, providing no PoC, exploit, patch, or active exploitation details.
CVE-2026-3311 Stored Cross-Site Scripting in Plus Addons for Elementor Progress Bar Shortcode https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3311
Post summary
The entry announces a stored XSS vulnerability (CVE‑2026‑3311) in Plus Addons for Elementor Progress Bar shortcode, but offers no PoC, exploit details, or mitigation information.