CVE-2026-15787
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker can inject malicious JavaScript that executes in visitors' browsers, leading to session theft, redirects, or other harmful actions.
Recommendation
Update the Ultimate Addons for Elementor plugin to the latest version. Restrict user permissions to the minimum necessary.
Other vulnerabilities in Ultimate Addons for Elementor
See all- CVE-2026-66688Medium
XSS vulnerability in Ultimate Addons for Elementor versions up to 1.45.2 allows a user with Contributor role to inject malicious script.
- CVE-2025-9703Medium
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
Original NVD description (English source)
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS