Ultimate Addons for Elementor <= 2.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Site Title and Tagline Widgets
- ID
- WPSEC-2026-2037
- Plugin
- Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder (header-footer-elementor)
- Affected
- all versions before 2.9.6
- Remediation
- Update to 2.9.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Ultimate Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the site name and tagline rendered by the Site Title and Site Tagline widgets in all versions up to, and including, 2.9.5. This is due to these values being output directly into the widgets' Elementor editor JavaScript (Underscore) template, filtered only by wp_kses_post(), which does not neutralize template delimiters. This makes it possible for authenticated attackers, with administrator-level access and above, to inject template code that executes as JavaScript when another user opens the Elementor editor. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2037/
- https://plugins.svn.wordpress.org/header-footer-elementor/tags/2.9.6/
- https://wordpress.org/plugins/header-footer-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS