EUVD-2026-83562
GHSA-vvxq-f8jw-xx64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor-level WordPress account
-
DeliveryEdit page with popover_btn widget
-
ExploitInject script via 'pop_tag' parameter
-
ExecutionPayload stored in page content
-
PersistAdmin/visitor views injected page
-
ImpactScript executes in their browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with contributor-level capabilities or higher on the target WordPress site, and the site must have the Gum Addon for Elementor plugin (<=1.3.15) active with the popover button widget available for use. Exploitation is limited by this authentication requirement - most valuable on multi-author sites or those allowing open contributor registration. Payload execution is deferred until a separate user (ideally an administrator) views the page containing the injected 'pop_tag' value; no victim interaction is needed to store the payload. |
| Impact | This is a moderate-severity, authenticated stored XSS in a niche Elementor add-on, best treated as a routine-priority patch rather than an emergency. The CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is internally consistent: network-reachable, low complexity, requires only contributor-level authentication (PR:L), needs no victim interaction to plant the payload, and the scope change (S:C) reflects script executing in the browser context of other users/admins who view the injected page. Impact is capped at C:L/I:L because it is client-side script injection, not server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so the real-world exploitation signal is low - this is no public exploit identified at time of analysis. The dominant limiting factor is the PR:L prerequisite: an attacker must already hold a contributor (or higher) account on the target WordPress site, which sharply narrows the population of exploitable installs to sites that permit untrusted user registration at contributor+ level. No key signals conflict; the vector matches the description well. |
| Exploit ScenarioDerived | An attacker who has registered or obtained a contributor-level account on a WordPress site running Gum Addon for Elementor edits a page/post using the popover button widget and injects a malicious script into the 'pop_tag' parameter. The payload is stored and later executes in the browser of any visitor or administrator who views the page, enabling session/cookie theft or admin-action forgery leading to potential privilege escalation. No public exploit code was identified, and exploitation requires a pre-existing authenticated foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Stored cross-site scripting in the Gum Addon for Elementor WordPress plugin (all versions up to and including 1.3.15) allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript via the 'pop_tag' parameter of the popover button widget, which then executes in the browser of any user - including administrators - who views the affected page. The prerequisite is a valid low-privilege account plus an active, widget-enabled installation, so risk is concentrated on multi-author sites or blogs that permit open contributor registration; no public exploit code has been identified at time of analysis, and CVSS 3.1 scores the issue 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact but a scope change because the payload crosses from the authoring context into other users' sessions.
RemediationAI
Patch status: upstream fix available (SVN changeset in the WordPress plugin repository - see https://plugins.trac.wordpress.org/changeset?reponame=&old=3556711%40gum-elementor-addon&new=3556711%40gum-elementor-addon); a released patched version number above 1.3.15 is not independently confirmed, so administrators should check the plugin's changelog and update to the first release newer than 1.3.15, or remove the plugin if no fixed release is listed. Until then, apply compensating controls with known trade-offs: disable or unregister the popover button widget (removes the feature but eliminates the sink), strip contributor-level accounts or require editorial approval for all contributions (blocks the injection path at the cost of publishing workflow friction), and sweep wp_posts/postmeta for unsanitized 'pop_tag' values before re-enabling widgets. Adding a Content-Security-Policy that disallows inline script will neutralize most payloads but may break other Elementor and third-party scripts, and a WAF rule filtering 'pop_tag' parameters or angle brackets in widget settings offers a short-term stopgap that can be bypassed by encoding tricks. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/143c3a66-ac67-48e1-800f-8479fd963da3?source=cve for vendor updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent variant. The Gum Addon for Elementor plugin registers a 'popover button' Elementor widget implemented in widgets/popover_btn.php, where the 'pop_tag' attribute is accepted from the widget settings (and therefore from any user who can place the widget in a post or template) without adequate sanitization on input and without escaping when rendered to the page; the advisory's code references point to lines 726 and 767 of that file in both trunk and the 1.3.15 tag. Because Elementor stores widget settings as post metadata rendered on the front end, the payload persists in the database and fires on every subsequent page view. The CPE string cpe:2.3:a:celomitan:gum_addon_for_elementor:*:*:*:*:*:*:*:* identifies the affected package under the vendor handle 'celomitan', and because the injected script executes in the security context of whichever user opens the page, the CVSS vector marks S:C (scope changed) with only L-tier confidentiality and integrity impact. WordPress contributor accounts cannot publish posts directly, but staging the payload in a draft or template is sufficient - execution is deferred until a privileged user previews or publishes the content, so no interaction is required at injection time.
Know when Gum Addon For Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level auth gives PR:L; stored payload needs no interaction to plant (UI:N); scope change (S:C) and C:L/I:L are standard for contributor stored XSS executing in other users' browsers.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB