CVE-2026-66688
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
XSS vulnerability in Ultimate Addons for Elementor versions up to 1.45.2 allows a user with Contributor role to inject malicious script.
Risk Assessment
Malicious script can be executed in the admin's browser, potentially leading to session theft or admin panel takeover.
Recommendation
Update the Ultimate Addons for Elementor plugin to the latest version that includes an XSS fix.
Other vulnerabilities in Ultimate Addons for Elementor
See all- CVE-2026-15787Medium
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2025-9703Medium
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS