Skip to content
XSS Vulnerabilities Found in WordPress Plugins

XSS Vulnerabilities Found in WordPress Plugins

First seen 30 Oct 2026, 22:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 00:13 UTC
  • •Two WordPress plugins have critical XSS vulnerabilities.
  • •The Plus Addons plugin requires a privileged user for exploitation.
  • •Analytics Insights plugin allows unauthenticated attackers to inject scripts.

Two WordPress plugins, The Plus Addons for Elementor Page Builder Lite and Analytics Insights, have been found to have Cross Site Scripting (XSS) vulnerabilities. The Plus Addons plugin, version 6.5.3, is affected by a low-severity XSS vulnerability that requires a privileged user to exploit. Users are advised to update to version 6.6.0 or later to mitigate this risk. Meanwhile, the Analytics Insights plugin is vulnerable to stored XSS in all versions up to 6.3.12, allowing unauthenticated attackers to inject scripts. This vulnerability has a CVSS score of 7.2, indicating a high severity level. Both plugins are widely used in WordPress sites, making the potential impact significant. Users should take immediate action to update their plugins to prevent exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
CVE-2026-111820 published
The Analytics Insights plugin was disclosed to have a stored XSS vulnerability affecting all versions up to 6.3.12.
Cve
2026-10-30
Patch released for The Plus Addons plugin
Users are urged to update The Plus Addons plugin to version 6.6.0 or later to resolve the XSS vulnerability.
Patchstack

More articles in this cluster (3)

Following this threat?

Track CVE-2026-111820 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

Which versions of The Plus Addons are affected?
The Plus Addons for Elementor Page Builder Lite plugin version 6.5.3 is affected.
What should I do if I can't update the plugin?
Contact your hosting provider or web developer for assistance with the update.
Is the Analytics Insights vulnerability being exploited?
The articles do not indicate any confirmed exploitation of the Analytics Insights vulnerability.