Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Total Portfolio Masonry Widget 'active_cat' Setting

ID

WPSEC-2026-0803

Plugin

Hash Elements (hash-elements)

Affected

from 1.0.4 before 1.5.7

Remediation

Update to 1.5.7 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12

Attack surface

Hash Elements on WPSec AttackSurface

Fix released

2026-10-11

Published

2026-10-12

Description

The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'active_cat' (Active Category) setting of the Total Portfolio Masonry widget in versions 1.0.4 to 1.5.5, due to insufficient input sanitization and output escaping. The value is placed into the data-active attribute of the widget's category filter list without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above who can edit content with Elementor, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

References

• https://wpsec.com/vuln/WPSEC-2026-0803/
• https://plugins.svn.wordpress.org/hash-elements/tags/1.5.7/
• https://wordpress.org/plugins/hash-elements/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS