wpvibes has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 7. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. Most affected products: anywhere-elementor (4), Dynific Addons for Elementor (formerly Anywhere Elementor) (2), addon-elements-for-elementor-page-builder (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Products
- anywhere-elementor 4
- Dynific Addons for Elementor (formerly Anywhere Elementor) 2
- addon-elements-for-elementor-page-builder 2
Worst active — by depth score
CVE-2026-103914Medium· 6.5Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter36CVE-2026-102564Medium· 6.5Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer36CVE-2026-114185Medium· 6.5WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability36CVE-2026-114183Medium· 6.5WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability36CVE-2026-114184Medium· 6.5WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability36
wpvibes vulnerabilities
CVEs affecting wpvibes, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-102564Medium· 6.5Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer
The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an a…
CVE-2026-103914Medium· 6.5Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter
The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient …
CVE-2026-119465Medium· 5.3WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a t…
CVE-2026-119467Medium· 5.4WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
CVE-2026-114187Medium· 5.3WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
CVE-2026-114185Medium· 6.5WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
CVE-2026-114183Medium· 6.5WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
CVE-2026-114184Medium· 6.5WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Element…