{
 "id": "WPSEC-2026-2036",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2036/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2036/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2036/index.md",
 "title": "Ultimate Addons for Elementor <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Page Title Widget",
 "description": "The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post or archive title rendered by the Page Title widget in all versions up to, and including, 2.9.5. This is due to the title being output directly into the widget's Elementor editor JavaScript (Underscore) template, filtered only by wp_kses_post(), which does not neutralize template delimiters such as '{{{ }}}' or '<# #>'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject template code into a post title that executes as JavaScript when a higher-privileged user opens the post in the Elementor editor.",
 "plugin": {
  "slug": "header-footer-elementor",
  "name": "Ultimate Addons for Elementor",
  "full_name": "Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder",
  "wordpress_org": "https://wordpress.org/plugins/header-footer-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/header-footer-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/header-footer-elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.9.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.9.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.9.6",
 "remediation": "Update to 2.9.6 or later.",
 "fix_released": "2026-10-29T10:04:21+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:37:45.351933+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2036/",
  "https://plugins.svn.wordpress.org/header-footer-elementor/tags/2.9.6/",
  "https://wordpress.org/plugins/header-footer-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/header-footer-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}