EUVD-2026-114273
GHSA-7mf7-6mwm-hxwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
DeliveryInject script into Elementor header/footer field
-
ExploitPayload stored unsanitized
-
ExecutionAdmin views affected content
-
ImpactScript executes in admin browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with sufficient privilege to save content into the affected Ultimate Addons for Elementor - Lite (header-footer-elementor) fields (CVSS PR:L), and it requires a victim to subsequently load the page or screen that renders the stored payload (CVSS UI:R). The specific input field and sanitization path are not described in the available sources. Limiting factors: no unauthenticated path (an account is needed), the stored script only fires when another user views the content, and only versions from n/a through 2.9.5 are affected. |
| Impact | This is a medium-severity stored XSS (CVSS 6.5) that should be treated as a routine, prioritized patch rather than an emergency. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privilege account (PR:L) and a victim's browser action (UI:R) to fire the injected script. The scope change (S:C) reflects that the payload executes in another user's security context - typically an administrator viewing attacker-supplied content. No EPSS score is supplied, the CVE is not listed in CISA KEV, and no verified exploit code is referenced - only a Patchstack advisory - so there is no signal of active exploitation. The vuln.today decision label is 'this_month,' consistent with a real-but-not-urgent stored XSS in a widely used plugin. The main gap in the data is the absence of EPSS and any confirmed fixed version; the limited-privilege and user-interaction requirements meaningfully constrain real-world risk compared to an unauthenticated XSS. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated WordPress account (e.g., contributor or an account allowed to edit header/footer template content) saves a crafted payload into an affected Ultimate Addons for Elementor - Lite field. When an administrator or other user later views the page or admin screen rendering that stored content, the script executes in their browser session. No verified public exploit code is referenced; only a Patchstack advisory is cited. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.
RemediationAI
No fixed version is named in the supplied data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/header-footer-elementor/vulnerability/wordpress-ultimate-addons-for-elementor-lite-plugin-2-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve is the authoritative source and should be checked for the patched release, and because the affected range ends at 2.9.5, any plugin update above 2.9.5 should be treated as the target once the advisory confirms it - until then, treat 2.9.5 and earlier as vulnerable. As compensating controls tied to the assessed exploitation conditions, restrict which WordPress roles and individual accounts may save content that flows into the plugin's header/footer fields, since the attack requires an authenticated account with that privilege (PR:L); the trade-off is reduced authoring autonomy for editors and contributors. Review existing stored header/footer configuration and any custom template content for injected markup, noting that the payload only fires when another user views the affected output (UI:R), so detection should look for unexpected script or HTML in plugin-managed fields. No patch data in the input confirms a vendor-released fix version, so re-verify the advisory before closing out the finding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin, Ultimate Addons for Elementor - Lite, whose header/footer elementor functionality accepts and later re-renders user-supplied content inside generated web pages. The root cause is improper neutralization of input during web page generation, classed as CWE-79 cross-site scripting, in its stored variant: rather than reflecting a value back in a single response, the malicious input is persisted and re-emitted whenever the affected template output is rendered, so a single injection can fire for multiple viewers. CPE data identifies brainstorm_force:ultimate_addons_for_elementor_-_lite with no version constraints, while the description bounds the vulnerable range at releases from n/a through 2.9.5. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable attack that needs only low-privileged authenticated access, requires a victim to load the crafted output, and crosses a scope boundary so the injected script acts in the context of the rendered page with limited confidentiality, integrity and availability impact. The precise input field and sanitization path involved are not described in the available sources.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Authenticated low-privilege user stores the payload (PR:L), a victim must render it (UI:R), and execution in the victim's context crosses a privilege boundary (S:C) with limited C/I/A impact typical of stored XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB