Ultimate Addons for Elementor <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Page Title Widget
- ID
- WPSEC-2026-2036
- Plugin
- Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder (header-footer-elementor)
- Affected
- all versions before 2.9.6
- Remediation
- Update to 2.9.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Ultimate Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post or archive title rendered by the Page Title widget in all versions up to, and including, 2.9.5. This is due to the title being output directly into the widget's Elementor editor JavaScript (Underscore) template, filtered only by wp_kses_post(), which does not neutralize template delimiters such as '{{{ }}}' or '<# #>'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject template code into a post title that executes as JavaScript when a higher-privileged user opens the post in the Elementor editor.
References
- https://wpsec.com/vuln/WPSEC-2026-2036/
- https://plugins.svn.wordpress.org/header-footer-elementor/tags/2.9.6/
- https://wordpress.org/plugins/header-footer-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS