CVE-2026-28131 WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability

MediumCVSS 6.5 EPSS 0.25%

Published: 2026-02-26 10:33
Updated: 2026-06-17 13:28
Exploit status: No public exploit known

Description

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through <= 1.14.4.

Affected products

Product	Affected versions	Fixed in
WPVibes Elementor Addon Elements	< 1.14.5	1.14.5
wordpress addon-elements-for-elementor-page-builder(WordPress)	< 1.14.5	1.14.5

References

patchstack.com vdb-entry
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.1

6.5 Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

All scores (3)

v3.1 6.5 · patchstack
v3.1 6.5 · audit@patchstack.com
v3.1 4.3 · wordfence

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.25% (percentile 17.1)
CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-201 Insertion of Sensitive Information Into Sent Data

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.