CVE-2026-15156 in Essential Addons for Elementor Plugin
Summary
by MITRE • 07/21/2026
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The Essential Addons for Elementor plugin represents a widely used extension within the WordPress ecosystem that provides various templates and widgets for the popular page builder Elementor. This particular vulnerability affects versions up to and including 6.6.11, creating a significant security risk for WordPress sites that utilize this plugin. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the Reading Progress Global Color Settings functionality, which serves as an attack vector for malicious actors with contributor-level privileges or higher.
The technical flaw manifests in how the plugin handles user input within the global color settings configuration for reading progress features. When authenticated attackers with contributor permissions or above modify these settings, the plugin fails to properly sanitize the input data before storing it in the database. Additionally, the output escaping mechanisms are insufficient to prevent malicious scripts from being executed when affected pages are rendered. This combination of weaknesses creates a persistent stored cross-site scripting vulnerability that allows attackers to inject arbitrary web scripts into the plugin's configuration parameters.
The operational impact of this vulnerability extends beyond simple script injection, as it provides attackers with the ability to execute malicious code within the context of any user who accesses pages containing the injected content. This means that legitimate site visitors could unknowingly become victims of phishing attacks, credential theft, or other malicious activities orchestrated through the compromised plugin. The vulnerability is particularly concerning because it requires only contributor-level access, which is often granted to trusted users who may not be fully aware of the security implications of their actions.
This vulnerability aligns with CWE-79, which describes Cross-Site Scripting flaws, and specifically reflects the characteristics of stored XSS attacks where malicious scripts are permanently stored on the target server. From an ATT&CK framework perspective, this represents a technique that enables initial access and persistence within a compromised WordPress environment through the manipulation of legitimate plugin functionality. The attack chain typically begins with gaining contributor-level privileges, which may be achieved through social engineering, credential compromise, or other means, followed by exploitation of this specific vulnerability to establish a persistent backdoor for further malicious activities.
Organizations should immediately update to the latest version of the Essential Addons for Elementor plugin to remediate this vulnerability, as no patch exists for versions prior to the fix. Administrators should also implement strict access controls and monitor user permissions to limit contributor-level access where possible. Additional mitigations include regular security audits of plugin configurations, implementation of content security policies, and monitoring for unauthorized modifications to plugin settings. The vulnerability demonstrates the critical importance of input validation and output escaping in web applications, particularly within CMS platforms where multiple users may have varying levels of administrative access.