CVE-2026-11328 is a Stored Cross-Site Scripting vulnerability in Exclusive Addons for Elementor through version 2.7.9.8. A Contributor or higher-privileged user can save a crafted post title that is inserted into the Ex Duplicator link in the WordPress Posts list without attribute escaping. Moving the mouse over that link triggers the injected script in the viewing user’s browser. The issue is fixed in version 2.7.9.9.
| CVE | CVE-2026-11328 |
| Plugin Version | Exclusive Addons for Elementor <= 2.7.9.8, fixed in 2.7.9.9 |
| All Time | 1 662 961 |
| Active installations | 50 000+ |
| Publicly Published | July 6, 2026 |
| Last Updated | July 10, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 – Cross-Site Scripting |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-11328 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/exclusive-addons-for-elementor/exclusive-addons-for-elementor-2798-authenticated-contributor-stored-cross-site-scripting-via-post-title |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| April 6, 2026 | Plugin testing and vulnerability detection in Exclusive Addons for Elementor were completed. |
| April 6, 2026 | The vulnerability report was sent with the PoC, technical description, and recommendations for remediation. |
| July 6, 2026 | Wordfence publicly published the advisory for CVE-2026-11328. |
Discovery of the Vulnerability
The vulnerable output is in extensions/post-duplicator.php. The Post_Duplicator::duplicate_actions() method adds the Ex Duplicator link through the post_row_actions and page_row_actions filters. It checks current_user_can('edit_posts'), a capability available to Contributors, before building the link.
The link is assembled with sprintf(), and $post->post_title is passed through the translation function __() into a double-quoted title attribute. Translation does not escape an HTML attribute. A stored double quote therefore closes the attribute and allows the supplied onmouseover handler to become part of the link. The duplication URL has a nonce, but the payload executes while the link is rendered and hovered, before any duplication request is sent.
Understanding of Stored Cross-Site Scripting attacks
Stored Cross-Site Scripting occurs when untrusted data is saved and later inserted into a context where a browser interprets it as executable markup. Here the stored value is a post title, and the output context is an attribute on an administrative row action. A title that is safe as ordinary text still needs separate escaping when it is used inside an HTML attribute.
A Contributor can create a draft without permission to publish it. That makes the Posts list a relevant boundary between a content contributor and users who review submissions. In the supplied PoC, execution requires the viewer to move the mouse over Ex Duplicator. If an editor or administrator does so, the script runs in that authenticated browser context and may affect data or actions available to the viewing session.
Exploiting the Stored Cross-Site Scripting Vulnerability
Use an isolated WordPress test site with an affected version of Exclusive Addons for Elementor and its Post Duplicator extension enabled. Sign in as a Contributor or another account that can create posts. The researcher supplied the following harmless alert demonstration.
POC:
POC: 1) Create and save a post with the following title " onmouseover="alert(1) 2) Open the Posts list and move your mouse over "Ex Duplicator" for that post.____
The alert demonstrates that the saved title has been interpreted as an event handler on the row action. Clicking Ex Duplicator is not required. The title persists in the post, so an affected installation can render the same injected handler on later visits to the Posts list.
Recommendations for Improved Security
Update Exclusive Addons for Elementor to 2.7.9.9 or a newer patched release. Review existing post titles for unexpected quotes and event-handler text. If an update cannot be applied immediately, disable the Post Duplicator extension and limit contributor access to trusted users until the fix is installed.
Developers should escape post titles with esc_attr() at the point where they are inserted into an HTML attribute and escape link destinations with esc_url(). Apply the same handling to both post and page row actions. Regression checks should cover titles with double quotes, angle brackets, ampersands, and event-handler text, while confirming that ordinary titles remain readable. Capability checks and nonces protect different boundaries and do not replace output escaping.
Fixing CVE-2026-11328 prevents contributor-controlled titles from becoming executable attributes in the WordPress dashboard. Context-appropriate escaping keeps the Ex Duplicator action safe when editors review saved posts.
#WordPressSecurity #StoredXSS #ExclusiveAddons #PluginSecurity #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
