{"id":"CVE-2026-9243","aliases":["EUVD-2026-33254","GHSA-p7qc-q5q2-fm5h"],"status":"published","title":"The Plus Addons for Elementor \u003c= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter","description":"The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00273,"percentile":0.19832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-05-29T06:43:41Z","modified":"2026-07-21T12:10:00Z","products":[{"vendor":"posimyththemes","product":"the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699e41ad-1991-4100-9ef2-caea7743e45b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.15/modules/widgets/tp_carousel_anything.php#L1187"},{"url":"https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.15/modules/widgets/tp_carousel_anything.php#L1143"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fthe-plus-addons-for-elementor-page-builder/tags/6.4.15\u0026new_path=%2Fthe-plus-addons-for-elementor-page-builder/tags/6.4.16"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9243"},{"url":"https://github.com/advisories/GHSA-p7qc-q5q2-fm5h"}],"sources":{"cve":[{"id":"CVE-2026-9243","title":"The Plus Addons for Elementor \u003c= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter","description":"The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-05-29T06:43:41.113Z","modified":"2026-05-29T10:06:02.975Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-33254","description":"The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-05-29T06:43:41Z","modified":"2026-05-29T10:06:02Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:01.680356Z"}],"ghsa":[{"id":"GHSA-p7qc-q5q2-fm5h","title":"The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting...","description":"The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-05-29T09:31:05Z","modified":"2026-05-29T09:31:12Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:08:22.826978Z"}],"nvd":[{"id":"CVE-2026-9243","description":"The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-05-29T08:16:19.627Z","modified":"2026-07-21T12:10:00.09Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:21.244426Z"}]}}