EUVD-2026-35378
GHSA-585f-32mf-v7f5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Prime Elementor Addons - Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML Tag Settings in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit succeeds even for users without the unfiltered_html capability because the payload (e.g., 'img src=x onerror=alert(document.domain)') contains no HTML angle brackets and therefore passes through Elementor's wp_kses_post() filter unchanged at save time.
AnalysisAI
Stored Cross-Site Scripting in Prime Elementor Addons for WordPress (all versions through 1.3.3) allows authenticated attackers with contributor-level access to persist malicious scripts in widget HTML Tag settings that execute in any visitor's browser on page load. The vulnerability is notable for a specific filter bypass: payloads crafted without HTML angle brackets (e.g., 'img src=x onerror=alert(document.domain)') pass unmodified through Elementor's wp_kses_post() sanitization at save time, meaning even users lacking the unfiltered_html capability can inject effective XSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The affected product is identified by CPE cpe:2.3:a:wpmessiah:prime_elementor_addons_-_lightweight_elementor_widgets_for_faster_pages:*:*:*:*:*:*:*:* and is distributed under the slug 'unlimited-elementor-inner-sections-by-boomdevs' on the WordPress plugin repository. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class. The vulnerability manifests in multiple widget components confirmed via Wordfence source references: InfoBox (lines 1623, 1645), Counter (line 1079), CallToAction (line 1631), TeamMember (line 2638), PostGridRenderer (line 164), and AdvancedAccordion (line 1396), all within the HTML Tag settings field. WordPress's wp_kses_post() filter - the standard mechanism for stripping dangerous HTML from lower-privilege user input - is bypassed because it operates on tag structure and angle brackets; payloads using event handler attributes on tag names supplied as plain strings (without '<' or '>') are treated as safe text and stored verbatim, only rendering as executable HTML when the page is output to the browser.
RemediationAI
No vendor-released patched version has been confirmed in the available data - the advisory identifies all versions through 1.3.3 as vulnerable with no fixed release cited. Site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/95136083-58d7-4ee4-b894-6910c3992d20?source=cve and the WordPress plugin repository for an updated release. As an immediate compensating control, restrict or eliminate contributor-level (and above) accounts that are not fully trusted, since the attack requires authenticated access at that privilege tier - revoking unnecessary contributor accounts directly reduces the attack surface with no functional side effect for inactive users. Alternatively, disable the affected plugin entirely until a patched version is available if the site does not depend on its widgets; this eliminates the vulnerability with the trade-off of losing widget rendering. If the plugin cannot be disabled, a web application firewall rule blocking event handler attribute strings (onerror=, onload=, etc.) in POST requests to the WordPress admin page-editor endpoints can reduce risk but may produce false positives in legitimate rich-text editing workflows.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today