What is the CVSS score of CVE-2026-15156?

CVE-2026-15156 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Essential Addons Elementor CVE-2026-15156

EUVD-2026-46149 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 Wordfence

GHSA-pfhx-5hrx-gx78

XSS WordPress Essential Addons For Elementor Popular Elementor Templates Widgets

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS execution requires victim to navigate to the injected page (UI:R); contributor privilege required to store payload; scope change affects victim browser beyond vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 05:06 vuln.today

CVE Published

Jul 21, 2026 - 04:33 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.

Technical ContextAI

The affected product is the Essential Addons for Elementor WordPress plugin by wpdevteam, identified by CPE cpe:2.3:a:wpdevteam:essential_addons_for_elementor_-_popular_elementor_templates_&_widgets:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the Stored variant. Source code references in the WordPress SVN repository pinpoint the vulnerable code paths to includes/Traits/Elements.php (L496), includes/Traits/Core.php (L185), and includes/Classes/Bootstrap.php (L145), all within the 6.6.10/6.6.11 tags. The Reading Progress Global Color Settings input is written to the WordPress database without adequate sanitization and rendered to page output without proper escaping, enabling persistent script injection that survives page reloads and affects all visitors.

RemediationAI

Upgrade to Essential Addons for Elementor version 6.7.0 or later, which contains the patch as confirmed by the WordPress.org SVN changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fessential-addons-for-elementor-lite/tags/6.6.11&new_path=%2Fessential-addons-for-elementor-lite/tags/6.7.0). The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/dde0cf3a-778b-4b5f-ac0e-600505d918ae provides additional remediation context. If immediate upgrade is not possible, the most effective compensating control is to audit and restrict contributor-level accounts - revoke contributor role from untrusted users, as this eliminates the attack surface entirely without modifying plugin configuration. Disabling the Reading Progress feature (if not in active use) would also eliminate the specific injection vector, though this may impact site UX. A WAF rule blocking script-tag patterns in color-setting parameters can provide detection and partial blocking but should not substitute for patching, as WAF evasion for XSS payloads is well-documented.