Authenticated Stored Cross-Site Scripting Vulnerability in Plus Addons for Elementor Plugin
CVE-2026-15285

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
The Plus Addons For Elementor – Addons For Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Vendor
CVE Published:
10 July 2026

What is CVE-2026-15285?

The Plus Addons for Elementor plugin for WordPress had a vulnerability that allowed Authenticated (Contributor+) users to execute arbitrary JavaScript via the Button widget's custom_attributes setting. This issue stemmed from a flaw in the render function of tp_button.php, which improperly sanitized input by passing it through a filter that could be bypassed. To mitigate this issue, users should update to version 6.4.12 or later, where the vulnerability has been patched.

Affected Version(s)

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce 0 <= 6.4.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/the-plus-addon...
https://plugins.trac.wordpress.org/browser/the-plus-addon...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17y
.