{
 "id": "WPSEC-2026-2037",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2037/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2037/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2037/index.md",
 "title": "Ultimate Addons for Elementor <= 2.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Site Title and Tagline Widgets",
 "description": "The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the site name and tagline rendered by the Site Title and Site Tagline widgets in all versions up to, and including, 2.9.5. This is due to these values being output directly into the widgets' Elementor editor JavaScript (Underscore) template, filtered only by wp_kses_post(), which does not neutralize template delimiters. This makes it possible for authenticated attackers, with administrator-level access and above, to inject template code that executes as JavaScript when another user opens the Elementor editor. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
 "plugin": {
  "slug": "header-footer-elementor",
  "name": "Ultimate Addons for Elementor",
  "full_name": "Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder",
  "wordpress_org": "https://wordpress.org/plugins/header-footer-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/header-footer-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/header-footer-elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.9.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.9.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.9.6",
 "remediation": "Update to 2.9.6 or later.",
 "fix_released": "2026-10-29T10:04:21+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:37:45.351933+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2037/",
  "https://plugins.svn.wordpress.org/header-footer-elementor/tags/2.9.6/",
  "https://wordpress.org/plugins/header-footer-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/header-footer-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}