What is the CVSS score of EUVD-2026-30231?

EUVD-2026-30231 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Plus Addons Elementor EUVD-2026-30231

| CVE-2026-5243 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 security@wordfence.com

GHSA-c5xw-v9qw-w8c3

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:54 vuln.today

CVE Published

May 14, 2026 - 06:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The The Plus Addons for Elementor - Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scripting via the menu_hover_click parameter of the Navigation Menu Lite widget in all versions up to, and including, 6.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in The Plus Addons for Elementor WordPress plugin (all versions through 6.4.11) allows authenticated contributors to persistently inject arbitrary JavaScript via the menu_hover_click parameter of the Navigation Menu Lite widget. The CVSS scope change (S:C) confirms the payload executes in visiting users' browser contexts rather than the attacker's, enabling session hijacking, credential harvesting, or admin account takeover against any user who loads an affected page. EPSS is very low at 0.03% (8th percentile) and SSVC confirms no known exploitation, but the low privilege bar - contributor access, which is routinely granted on multi-author WordPress sites - elevates practical risk above what the medium CVSS score alone suggests.

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS rooted in insufficient sanitization of user-supplied input and missing output escaping in the Navigation Menu Lite widget's rendering logic. The NVD Trac changeset reference pinpoints the vulnerable file as modules/widgets/tp_navigation_menu_lite.php within the plugin package, and the diff between tags 6.4.11 and 6.4.12 confirms where the fix was applied. The plugin extends Elementor's page builder functionality for WordPress, meaning injected payloads are embedded inside Elementor widget output and persist in post/page content stored in the WordPress database, executing on every subsequent page load for any visitor.

RemediationAI

Upgrade The Plus Addons for Elementor to version 6.4.12 or later, which contains the fix confirmed by the Trac changeset diff between tags 6.4.11 and 6.4.12 in tp_navigation_menu_lite.php (referenced in NVD). The patched version is available via the WordPress plugin repository. If immediate upgrade is not possible, restrict contributor-level (and above) role assignments to fully trusted users only, as the vulnerability requires authenticated access; reducing the contributor user population directly limits the exploit surface. Additionally, a web application firewall rule targeting script injection patterns in widget parameter submissions can serve as a secondary compensating control, though WAF rules may produce false positives on legitimate navigation menu configurations. No workaround eliminates the vulnerability in the underlying code - patching to 6.4.12 is the only definitive fix.