What is the CVSS score of CVE-2026-15285?

CVE-2026-15285 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Plus Addons Elementor CVE-2026-15285

EUVD-2026-42794 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 security@wordfence.com

GHSA-653v-fpr2-j969

PHP WordPress XSS

6.4

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS inherently requires a victim to render the page (UI:R); all other metrics align with the official vector including scope change and low privilege.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 05:53 vuln.today

CVE Published

Jul 10, 2026 - 05:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's custom_attributes setting in versions up to and including 6.4.11. The render function in modules/widgets/tp_button.php passed the raw custom_attributes string through tp_senitize_js_input(). This filter is bypassable. The issue is patched in version 6.4.12.

AnalysisAI

Stored Cross-Site Scripting in The Plus Addons for Elementor WordPress plugin (versions through 6.4.11) allows authenticated contributors to inject persistent malicious scripts into pages via the Button widget's custom_attributes parameter. The root cause is a bypassable sanitization filter (tp_senitize_js_input()) in modules/widgets/tp_button.php that fails to properly neutralize HTML/JS content before rendering. When an administrator or other privileged user subsequently views an affected page, the stored payload executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit identified at time of analysis; patch is available in version 6.4.12.

Technical ContextAI

The vulnerability resides in The Plus Addons for Elementor, a third-party WordPress plugin extending the Elementor page builder. The affected code path is the render() method in modules/widgets/tp_button.php (observable across tags 6.4.10 through 6.4.11 in the WordPress plugin repository), which accepts a custom_attributes string from Elementor widget settings and passes it through tp_senitize_js_input() defined in modules/helper-function.php. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) applies: the sanitization function does not adequately strip or encode HTML event handlers or script constructs before the value is emitted into the rendered HTML output. Because Elementor stores widget configurations in post metadata, the payload persists server-side and is served to every user who loads the page, classifying this as Stored (Persistent) XSS. The CVSS scope-change metric (S:C) reflects that script execution occurs in a browser context outside the plugin's own trust boundary.

RemediationAI

Update The Plus Addons for Elementor to version 6.4.12 or later, which contains the patched render() function in tp_button.php. The fix can be applied via the WordPress admin dashboard (Plugins > Updates) or WP-CLI (wp plugin update the-plus-addons-for-elementor-page-builder). The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3217f9-67e5-488d-b80a-49a61678fb98 provides additional context. As an interim compensating control where immediate patching is not feasible, restrict the WordPress Contributor role from creating or editing Elementor-enabled posts - this removes the attack surface without disabling the plugin entirely, though it may affect editorial workflows. Disabling the Button widget in Elementor's feature manager is a more targeted workaround but may break existing page designs. A Web Application Firewall with XSS rulesets (e.g., Wordfence's own firewall) can provide partial mitigation but should not substitute for patching.