EUVD-2026-35378
GHSA-585f-32mf-v7f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress contributor credentials
-
DeliveryEdit page with affected Elementor widget
-
ExploitInject angle-bracket-free event handler in HTML Tag field
-
ExecutionPayload bypasses wp_kses_post() and is stored
-
PersistVictim browser loads injected page
-
ImpactMalicious script executes in victim session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authentication as a WordPress contributor (or higher role) is required, confirmed by CVSS PR:L. The target WordPress site must have the Prime Elementor Addons plugin installed and active in a version at or below 1.3.3. The attacker must have edit access to at least one page or post that uses an affected widget type (InfoBox, Counter, CallToAction, TeamMember, PostGridRenderer, or AdvancedAccordion) and must configure the widget's HTML Tag setting with the bypass payload. Critically, the bypass does NOT require the unfiltered_html capability, meaning it works even when WordPress enforces wp_kses_post() for lower-privilege roles - this removes a commonly assumed limiting factor for contributor-class stored XSS. Exploitation is further conditioned on a victim (any authenticated or unauthenticated user with access to the injected page) loading that page in a browser after the malicious save. Sites restricting contributor account creation or limiting page-editing permissions to trusted users are at reduced risk. |
| Impact | The CVSS 6.4 (Medium) score is derived from a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The Changed Scope (S:C) reflects the core stored XSS dynamic: the attacker's injection crosses security boundaries to impact site visitors. PR:L correctly reflects the contributor-level authentication requirement, which is a meaningful but non-trivial barrier - contributor accounts are common on multi-author blogs, editorial sites, and open-registration WordPress installations. The UI:N designation warrants scrutiny: stored XSS canonically requires a victim to load the injected page (UI:R from the victim's perspective), yet NVD/Wordfence scored it UI:N, possibly treating 'no additional attacker interaction after injection' as the reference point. This scoring ambiguity should be verified with the vendor. No EPSS data was provided; without KEV listing or public POC, exploitation risk is assessed as elevated opportunistic rather than imminent targeted. The filter bypass technique (angle-bracket-free payloads) is technically precise and may lower the effective exploitation complexity below what AC:L alone conveys, since it requires knowledge of the specific evasion method. Real-world prioritization should be elevated for sites with open contributor registration or untrusted editorial staff. |
| Exploit ScenarioDerived | An attacker who holds or obtains a WordPress contributor account navigates to the page/post editor, inserts a Prime Elementor Addons widget (such as InfoBox or CallToAction), and sets the HTML Tag field to a value like 'img src=x onerror=alert(document.domain)' - a string containing no angle brackets that passes through wp_kses_post() unchallenged. Once the page is published or saved as a draft and later viewed by an administrator or site visitor, the injected event handler fires in the victim's browser, enabling session cookie theft, credential harvesting via fake login overlays, or redirection to attacker-controlled infrastructure. No public exploit code has been identified, but the bypass technique is straightforward enough to replicate from the CVE description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Stored Cross-Site Scripting in Prime Elementor Addons for WordPress (all versions through 1.3.3) allows authenticated attackers with contributor-level access to persist malicious scripts in widget HTML Tag settings that execute in any visitor's browser on page load. The vulnerability is notable for a specific filter bypass: payloads crafted without HTML angle brackets (e.g., 'img src=x onerror=alert(document.domain)') pass unmodified through Elementor's wp_kses_post() sanitization at save time, meaning even users lacking the unfiltered_html capability can inject effective XSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
RemediationAI
No vendor-released patched version has been confirmed in the available data - the advisory identifies all versions through 1.3.3 as vulnerable with no fixed release cited. Site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/95136083-58d7-4ee4-b894-6910c3992d20?source=cve and the WordPress plugin repository for an updated release. As an immediate compensating control, restrict or eliminate contributor-level (and above) accounts that are not fully trusted, since the attack requires authenticated access at that privilege tier - revoking unnecessary contributor accounts directly reduces the attack surface with no functional side effect for inactive users. Alternatively, disable the affected plugin entirely until a patched version is available if the site does not depend on its widgets; this eliminates the vulnerability with the trade-off of losing widget rendering. If the plugin cannot be disabled, a web application firewall rule blocking event handler attribute strings (onerror=, onload=, etc.) in POST requests to the WordPress admin page-editor endpoints can reduce risk but may produce false positives in legitimate rich-text editing workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is identified by CPE cpe:2.3:a:wpmessiah:prime_elementor_addons_-_lightweight_elementor_widgets_for_faster_pages:*:*:*:*:*:*:*:* and is distributed under the slug 'unlimited-elementor-inner-sections-by-boomdevs' on the WordPress plugin repository. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class. The vulnerability manifests in multiple widget components confirmed via Wordfence source references: InfoBox (lines 1623, 1645), Counter (line 1079), CallToAction (line 1631), TeamMember (line 2638), PostGridRenderer (line 164), and AdvancedAccordion (line 1396), all within the HTML Tag settings field. WordPress's wp_kses_post() filter - the standard mechanism for stripping dangerous HTML from lower-privilege user input - is bypassed because it operates on tag structure and angle brackets; payloads using event handler attributes on tag names supplied as plain strings (without '<' or '>') are treated as safe text and stored verbatim, only rendering as executable HTML when the page is output to the browser.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Prime Elementor Addons - Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML Tag Settings in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit succeeds even for users without the unfiltered_html capability because the payload (e.g., 'img src=x onerror=alert(document.domain)') contains no HTML angle brackets and therefore passes through Elementor's wp_kses_post() filter unchanged at save time.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB