EUVD-2026-14153
GHSA-qhv2-5w8w-mqqm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The PQ Addons - Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on the html_tag parameter in the PQ Section Title widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The PQ Addons - Creative Elementor Widgets plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Section Title widget's html_tag parameter due to insufficient input sanitization and output escaping. All versions up to and including 1.0.0 are affected, allowing authenticated attackers with contributor-level access or above to inject arbitrary JavaScript that executes when users view affected pages. The vulnerability has a CVSS score of 6.4 (Medium) and exploits are possible since the attack requires only low privilege levels and no user interaction beyond page access.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting) within the PeacefulQode PQ Addons plugin (CPE: cpe:2.3:a:peacefulqode:pq_addons_–_creative_elementor_widgets). Elementor is a popular WordPress page builder that allows widgets to render dynamic content. The Section Title widget accepts an html_tag parameter intended to specify HTML heading levels (h1, h2, etc.), but this parameter is passed directly to output without proper escaping via functions like wp_kses_post() or esc_attr(). Code analysis from the WordPress plugin repository shows the vulnerability exists in both style-1.php and style-2.php template files (lines 20 and 26 respectively) where the html_tag value is interpolated into the rendered output, allowing attackers to inject script tags or event handlers within the tag itself.
RemediationAI
Update the PQ Addons – Creative Elementor Widgets plugin to a patched version beyond 1.0.0 as soon as a vendor release becomes available. Review the Wordfence threat intelligence and official plugin repository for patch availability. Immediately restrict contributor-level access to trusted content authors only, and audit recent changes to pages using the Section Title widget for suspicious script injections. As a temporary mitigation before patching, disable the Section Title widget entirely via plugin settings or code if alternatives exist, or restrict page editing capability to administrator-only accounts. Additionally, implement WordPress security hardening measures including Content Security Policy (CSP) headers to mitigate XSS impact, enable the WordPress Security plugin Wordfence for real-time attack detection, and regularly monitor user account activity for indicators of compromise. Database backups should be taken before any remediation to ensure recovery options if stored XSS payloads have already been injected.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today