CVE-2026-15285
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Plus Addons for Elementor plugin for WordPress up to version 6.4.11 is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting. The `render` function passes the raw string through `tp_senitize_js_input()`, which is bypassable.
Risk Assessment
An attacker can inject malicious JavaScript that executes in other users' browsers (including administrators), potentially leading to session theft, content modification, or privilege escalation.
Recommendation
Immediately update the Plus Addons for Elementor plugin to version 6.4.12 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Plus Addons for Elementor
See all- CVE-2026-9243Medium
The Plus Addons for Elementor plugin for WordPress up to version 6.4.15 contains a stored XSS vulnerability via the 'carousel_direction' parameter in the Carousel Anything widget. Insufficient output escaping in the render() function allows HTML attribute injection, enabling authenticated attackers (contributor-level and above) to inject arbitrary scripts.
- CVE-2025-9698Medium
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
Original NVD description (English source)
The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS