# Hash Elements <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel and Logo Carousel Widget 'data-params' Attribute

- **ID:** WPSEC-2026-0804
- **Plugin:** Hash Elements (`hash-elements`), https://wordpress.org/plugins/hash-elements/
- **Affected versions:** from 1.1.6 before 1.5.7
- **Fixed in:** 1.5.7 (Update to 1.5.7 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/hash-elements
- **Fix released:** 2026-10-11
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0804/

## Description

The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slide count, margin and stage padding settings of the Carousel Module One widget and the tablet and mobile slide count and margin settings of the Total Logo Carousel and Square Plus Logo Carousel widgets in versions 1.1.6 to 1.5.5. Because of an operator precedence error, the integer cast was applied to the isset() result instead of the setting value, so the raw values were JSON-encoded and echoed without escaping inside a single-quoted data-params attribute. This makes it possible for authenticated attackers, with Contributor-level access and above who can edit content with Elementor, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-0804/
- https://plugins.svn.wordpress.org/hash-elements/tags/1.5.7/
- https://wordpress.org/plugins/hash-elements/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0804/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.