# Ultimate Addons for Elementor <= 2.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Site Title and Tagline Widgets

- **ID:** WPSEC-2026-2037
- **Plugin:** Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder (`header-footer-elementor`), https://wordpress.org/plugins/header-footer-elementor/
- **Affected versions:** all versions before 2.9.6
- **Fixed in:** 2.9.6 (Update to 2.9.6 or later.)
- **Severity:** Medium 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/header-footer-elementor
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2037/

## Description

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the site name and tagline rendered by the Site Title and Site Tagline widgets in all versions up to, and including, 2.9.5. This is due to these values being output directly into the widgets' Elementor editor JavaScript (Underscore) template, filtered only by wp_kses_post(), which does not neutralize template delimiters. This makes it possible for authenticated attackers, with administrator-level access and above, to inject template code that executes as JavaScript when another user opens the Elementor editor. This only affects multi-site installations and installations where unfiltered_html has been disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2037/
- https://plugins.svn.wordpress.org/header-footer-elementor/tags/2.9.6/
- https://wordpress.org/plugins/header-footer-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2037/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.