{"id":"CVE-2026-15787","aliases":["EUVD-2026-47620","GHSA-4r37-9m26-2c4m"],"status":"published","title":"Ultimate Addons for Elementor \u003c= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes","description":"The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00419,"percentile":0.3664,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-22T08:33:30Z","modified":"2026-07-22T19:16:55Z","products":[{"vendor":"brainstorm force","product":"ultimate addons for elementor"},{"vendor":"brainstormforce","product":"ultimate addons for elementor"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f26d35-a702-49fc-aed1-0a329ac32553?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.8.8/inc/js/frontend.js#L682"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.8.8/inc/js/frontend.js#L701"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.9.1/inc/js/frontend.js#L684"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.9.1/inc/js/frontend.js#L703"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.9.1/inc/js/frontend.js#L682"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.9.1/inc/js/frontend.js#L701"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.8.8/inc/js/frontend.js#L684"},{"url":"https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.8.8/inc/js/frontend.js#L703"},{"url":"https://plugins.trac.wordpress.org/changeset/3614409/header-footer-elementor/trunk/inc/js/frontend.js"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fheader-footer-elementor/tags/2.9.1\u0026new_path=%2Fheader-footer-elementor/tags/2.9.2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15787"},{"url":"https://github.com/advisories/GHSA-4r37-9m26-2c4m"}],"sources":{"cve":[{"id":"CVE-2026-15787","title":"Ultimate Addons for Elementor \u003c= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes","description":"The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.","status":"published","published":"2026-07-22T08:33:30.358Z","modified":"2026-07-22T18:48:34.168Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-47620","description":"The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.","status":"published","published":"2026-07-22T08:33:30Z","modified":"2026-07-22T18:48:34Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:44.868793Z"}],"ghsa":[{"id":"GHSA-4r37-9m26-2c4m","title":"The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site...","description":"The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.","status":"published","published":"2026-07-22T09:32:14Z","modified":"2026-07-22T09:32:21Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:38.678188Z"}],"nvd":[{"id":"CVE-2026-15787","description":"The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.","status":"published","published":"2026-07-22T09:16:27.847Z","modified":"2026-07-22T19:16:55.353Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:32.089897Z"}]}}