Vulnerabilities / Make Column Clickable Elementor / WPSEC-2026-1700
Make Column Clickable Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-column-clickable' Attribute
Medium 5.4
CWE-79Fixed in 1.7.3
- ID
- WPSEC-2026-1700
- Plugin
- Make Column Clickable for Elementor (make-column-clickable-elementor)
- Affected
- all versions before 1.7.3
- Remediation
- Update to 1.7.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- Make Column Clickable Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Make Column Clickable for Elementor plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the 'data-column-clickable' attribute in all versions up to, and including, 1.7.2. This is due to the front-end script using the attribute value of any matching element on the page as a link target without validating the URL scheme. This makes it possible for authenticated attackers, with contributor-level access and above, to embed an element with a javascript: URL in post content, which executes arbitrary script in the browser of a user who clicks the element.
References
- https://wpsec.com/vuln/WPSEC-2026-1700/
- https://plugins.svn.wordpress.org/make-column-clickable-elementor/tags/1.7.3/
- https://wordpress.org/plugins/make-column-clickable-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS