# Ultimate Addons for Elementor <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Page Title Widget

- **ID:** WPSEC-2026-2036
- **Plugin:** Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder (`header-footer-elementor`), https://wordpress.org/plugins/header-footer-elementor/
- **Affected versions:** all versions before 2.9.6
- **Fixed in:** 2.9.6 (Update to 2.9.6 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/header-footer-elementor
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2036/

## Description

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post or archive title rendered by the Page Title widget in all versions up to, and including, 2.9.5. This is due to the title being output directly into the widget's Elementor editor JavaScript (Underscore) template, filtered only by wp_kses_post(), which does not neutralize template delimiters such as '{{{ }}}' or '<# #>'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject template code into a post title that executes as JavaScript when a higher-privileged user opens the post in the Elementor editor.

## References

- https://wpsec.com/vuln/WPSEC-2026-2036/
- https://plugins.svn.wordpress.org/header-footer-elementor/tags/2.9.6/
- https://wordpress.org/plugins/header-footer-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2036/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.