Stored Cross-Site Scripting Vulnerability in Ultimate Addons for Elementor by WordPress

CVE-2026-15787

What is CVE-2026-15787?

The Ultimate Addons for Elementor plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability through the Navigation Menu Widget attributes, specifically data-toggle-icon and data-close-icon. The flaw arises from inadequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts. When a user accesses affected pages, these scripts can execute, posing significant security risks. The wp_kses_post function, intended to sanitize content, fails to neutralize HTML-entity-encoded payloads stored in data-* attributes, as browsers decode these values client-side prior to rendering them, making it imperative to update to the latest version to mitigate threats.

References