Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel and Logo Carousel Widget 'data-params' Attribute
- ID
- WPSEC-2026-0804
- Plugin
- Hash Elements (hash-elements)
- Affected
- from 1.1.6 before 1.5.7
- Remediation
- Update to 1.5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Hash Elements on WPSec AttackSurface
- Fix released
- Published
Description
The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slide count, margin and stage padding settings of the Carousel Module One widget and the tablet and mobile slide count and margin settings of the Total Logo Carousel and Square Plus Logo Carousel widgets in versions 1.1.6 to 1.5.5. Because of an operator precedence error, the integer cast was applied to the isset() result instead of the setting value, so the raw values were JSON-encoded and echoed without escaping inside a single-quoted data-params attribute. This makes it possible for authenticated attackers, with Contributor-level access and above who can edit content with Elementor, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0804/
- https://plugins.svn.wordpress.org/hash-elements/tags/1.5.7/
- https://wordpress.org/plugins/hash-elements/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS