CVE-2026-9243
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Plus Addons for Elementor plugin for WordPress up to version 6.4.15 contains a stored XSS vulnerability via the 'carousel_direction' parameter in the Carousel Anything widget. Insufficient output escaping in the render() function allows HTML attribute injection, enabling authenticated attackers (contributor-level and above) to inject arbitrary scripts.
Risk Assessment
An attacker can inject a malicious script that executes whenever a user visits the injected page, potentially leading to session theft, redirects, or data theft.
Recommendation
Immediately update the Plus Addons for Elementor plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Plus Addons for Elementor
See all- CVE-2026-15285Medium
The Plus Addons for Elementor plugin for WordPress up to version 6.4.11 is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting. The `render` function passes the raw string through `tp_senitize_js_input()`, which is bypassable.
- CVE-2025-9698Medium
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
Original NVD description (English source)
The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS