EUVD-2026-47620
GHSA-4r37-9m26-2c4m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to visit the injected page (UI:R); all other vendor-provided metrics are retained as they correctly reflect network delivery, low complexity, contributor-level auth, scope change, and limited C/I impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.
AnalysisAI
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin allows authenticated contributors to implant persistent JavaScript payloads via the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes, affecting all versions through 2.9.1. The attack survives WordPress's wp_kses_post sanitization because the filter does not decode HTML entities within data-* attribute values at save time, while the browser subsequently decodes them client-side before jQuery's .html() renders them as live markup. No public exploit code or CISA KEV listing is identified at time of analysis, but the low privilege bar - contributor access on any multi-user WordPress site - and the scope-changed CVSS impact make this a meaningful risk wherever open or broad contributor registration is permitted.
Technical ContextAI
The flaw resides in the Navigation Menu Widget's frontend JavaScript rendering logic within the Ultimate Addons for Elementor plugin (WordPress repository slug: header-footer-elementor - see Confidence Notes for product-naming discrepancy), specifically in inc/js/frontend.js at lines 682, 684, 701, and 703, confirmed present in tags 2.8.8 and 2.9.1. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting). WordPress applies wp_kses_post on save for contributors who lack the unfiltered_html capability; this sanitizer permits a set of kses-approved tags and attributes but evaluates data-* attribute values as opaque strings without decoding their HTML entities. An attacker places an entity-encoded payload such as <img src=x onerror=alert(1)> into data-toggle-icon or data-close-icon. The serialized widget data passes wp_kses_post unmodified because the encoded form contains no prohibited raw tags. When a victim's browser renders the page, it decodes the entities before passing the string to jQuery's .html() call, which interprets the decoded result as HTML markup and executes the embedded script under the site's origin.
RemediationAI
Update the plugin to version 2.9.2 or later, which contains the upstream fix per the WordPress plugin repository changeset referenced above; the update can be applied through the WordPress admin Plugins panel or via WP-CLI using wp plugin update header-footer-elementor. As a compensating control prior to patching, restrict contributor and author roles to fully trusted users and audit existing accounts at those privilege levels - removing contributor access eliminates the injection vector entirely, though this may disrupt legitimate editorial workflows. Temporarily disabling the Navigation Menu Widget within Elementor (or deactivating the plugin) will prevent exploitation at the cost of losing navigation menu widget functionality on affected pages. A WAF rule targeting HTML-entity-encoded angle-bracket sequences in widget attribute POST parameters can reduce risk but carries a risk of false positives on legitimate rich-text content. No separate vendor security advisory URL beyond the Wordfence intelligence record has been identified in the available data; monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/39f26d35-a702-49fc-aed1-0a329ac32553 for updates.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today