{
 "id": "WPSEC-2026-0804",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0804/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0804/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0804/index.md",
 "title": "Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel and Logo Carousel Widget 'data-params' Attribute",
 "description": "The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slide count, margin and stage padding settings of the Carousel Module One widget and the tablet and mobile slide count and margin settings of the Total Logo Carousel and Square Plus Logo Carousel widgets in versions 1.1.6 to 1.5.5. Because of an operator precedence error, the integer cast was applied to the isset() result instead of the setting value, so the raw values were JSON-encoded and echoed without escaping inside a single-quoted data-params attribute. This makes it possible for authenticated attackers, with Contributor-level access and above who can edit content with Elementor, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "hash-elements",
  "name": "Hash Elements",
  "full_name": "Hash Elements",
  "wordpress_org": "https://wordpress.org/plugins/hash-elements/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hash-elements/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hash-elements"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.1.6",
    "from_inclusive": true,
    "to": "1.5.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.1.6 before 1.5.7"
  ]
 },
 "introduced_in": "1.1.6",
 "fixed_in": "1.5.7",
 "remediation": "Update to 1.5.7 or later.",
 "fix_released": "2026-10-11T14:49:39+00:00",
 "published": "2026-10-12T14:50:42+00:00",
 "updated": "2026-10-12T11:06:38.392149+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0804/",
  "https://plugins.svn.wordpress.org/hash-elements/tags/1.5.7/",
  "https://wordpress.org/plugins/hash-elements/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hash-elements",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}