EUVD-2026-33254
GHSA-p7qc-q5q2-fm5h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in The Plus Addons for Elementor WordPress plugin (versions up to and including 6.4.15) allows authenticated contributor-level attackers to persistently inject malicious scripts via the carousel_direction parameter of the Carousel Anything widget. The root cause is an unquoted HTML attribute context in the render() function where esc_attr() is applied but insufficient - attribute injection is still possible by appending space-separated event handlers to the bare dir= attribute. Injected payloads persist in the database and execute in any visiting user's browser, including administrators, enabling session hijacking or privilege escalation; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the Carousel Anything widget implementation within tp_carousel_anything.php (lines 1143 and 1187) of the posimyththemes plugin (CPE: cpe:2.3:a:posimyththemes:the_plus_addons_for_elementor_-_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class. The specific flaw is a context mismatch: the WordPress esc_attr() function correctly escapes quote characters and standard HTML special characters, but the carousel_direction value is output into an unquoted HTML attribute (dir=value rather than dir='value'), meaning an attacker can inject a space followed by arbitrary HTML attributes such as event handlers (e.g., dir=rtl onmouseover=alert(document.cookie)). This is a well-known bypass pattern for esc_attr() when the quoting context is absent from the output template.
RemediationAI
Upgrade The Plus Addons for Elementor plugin to version 6.4.16 or later - a WordPress.org changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fthe-plus-addons-for-elementor-page-builder/tags/6.4.15&new_path=%2Fthe-plus-addons-for-elementor-page-builder/tags/6.4.16) confirms code changes were introduced between 6.4.15 and 6.4.16; note that 6.4.16 as the confirmed patched release is inferred from this changeset reference rather than an explicit vendor patch advisory - verify against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/699e41ad-1991-4100-9ef2-caea7743e45b before treating it as authoritative. As a compensating control where immediate upgrade is not feasible, restrict WordPress contributor and author role assignments exclusively to fully trusted users, since this is the minimum privilege level required for exploitation; removing or auditing untrusted contributor accounts directly eliminates the attack surface with no functional side effects to the plugin itself. A WAF rule rejecting space-separated attribute injection patterns (event handler keywords following a space in widget parameter fields) can provide an additional layer of defense with low risk of false positives against legitimate carousel_direction values.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today