Stored Cross-Site Scripting in Essential Addons for Elementor by WordPress

CVE-2026-15156

What is CVE-2026-15156?

The Essential Addons for Elementor plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the Reading Progress Global Color Settings feature. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages, which will subsequently execute in the browser of any user accessing those pages, potentially leading to unauthorized actions or data exposure.

References