What is the CVSS score of EUVD-2026-14153?

EUVD-2026-14153 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14153?

Organizations using PQ Addons - Creative Elementor Widgets should be aware of moderate risk from CVE-2026-1397, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate EUVD-2026-14153?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14153

| CVE-2026-1397 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-qhv2-5w8w-mqqm

WordPress XSS Elementor

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14153

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The PQ Addons - Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on the html_tag parameter in the PQ Section Title widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The PQ Addons - Creative Elementor Widgets plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Section Title widget's html_tag parameter due to insufficient input sanitization and output escaping. All versions up to and including 1.0.0 are affected, allowing authenticated attackers with contributor-level access or above to inject arbitrary JavaScript that executes when users view affected pages. The vulnerability has a CVSS score of 6.4 (Medium) and exploits are possible since the attack requires only low privilege levels and no user interaction beyond page access.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting) within the PeacefulQode PQ Addons plugin (CPE: cpe:2.3:a:peacefulqode:pq_addons_–_creative_elementor_widgets). Elementor is a popular WordPress page builder that allows widgets to render dynamic content. The Section Title widget accepts an html_tag parameter intended to specify HTML heading levels (h1, h2, etc.), but this parameter is passed directly to output without proper escaping via functions like wp_kses_post() or esc_attr(). Code analysis from the WordPress plugin repository shows the vulnerability exists in both style-1.php and style-2.php template files (lines 20 and 26 respectively) where the html_tag value is interpolated into the rendered output, allowing attackers to inject script tags or event handlers within the tag itself.

RemediationAI

Update the PQ Addons – Creative Elementor Widgets plugin to a patched version beyond 1.0.0 as soon as a vendor release becomes available. Review the Wordfence threat intelligence and official plugin repository for patch availability. Immediately restrict contributor-level access to trusted content authors only, and audit recent changes to pages using the Section Title widget for suspicious script injections. As a temporary mitigation before patching, disable the Section Title widget entirely via plugin settings or code if alternatives exist, or restrict page editing capability to administrator-only accounts. Additionally, implement WordPress security hardening measures including Content Security Policy (CSP) headers to mitigate XSS impact, enable the WordPress Security plugin Wordfence for real-time attack detection, and regularly monitor user account activity for indicators of compromise. Database backups should be taken before any remediation to ensure recovery options if stored XSS payloads have already been injected.