Ultimate Addons for Elementor EUVD-2026-53898

Exploitation requires the attacker to possess a valid Contributor-level (or higher) account on the target WordPress site - this is a low-privilege but authenticated role. The site must have Ultimate Addons for Elementor version 1.45.2 or earlier installed and active, which in turn requires Elementor page builder to be present. A separate privileged user (editor or administrator) must interact with the attacker-crafted content - either by viewing, previewing, or editing the affected post or page - for the XSS payload to execute in their browser. Exploitation is limited to WordPress deployments that allow open or semi-open contributor registration, or where an insider threat or account compromise provides the required role. Sites with no contributor-level accounts and no public registration are not exploitable without prior account compromise.

The NVD CVSS score of 6.5 (Medium) reflects the PR:L and UI:R requirements, which meaningfully constrain real-world exploitability: an attacker must hold a Contributor-level WordPress account and must induce a privileged user to view the affected content. There is no KEV listing and no public exploit identified, keeping the practical threat level moderate. The S:C scope change is the most significant risk amplifier - successful exploitation targeting an administrator's session could yield full site takeover through credential theft, malicious plugin installation, or account creation. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. The Patchstack report adds credibility to the vulnerability's existence and severity. Overall: this is a genuine medium-priority issue for multi-author WordPress deployments where untrusted users hold Contributor accounts; single-author or tightly-controlled sites face lower realistic risk.

An attacker registers or compromises a Contributor-level WordPress account on a target site running Ultimate Addons for Elementor <= 1.45.2. They craft a post or page using a vulnerable Elementor widget field, embedding a JavaScript payload that exfiltrates the document cookie or performs an admin action via CSRF. When the site administrator reviews, previews, or publishes the draft, the script executes in their browser, potentially surrendering their session token or silently adding a rogue admin account. No public proof-of-concept code has been identified at time of analysis.