CVE-2026-15787 in Ultimate Addons for Elementor Plugin
Summary
by MITRE • 07/22/2026
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post, applied on save for users without unfiltered_html, does not neutralize HTML-entity-encoded payloads stored inside data-* attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in Ultimate Addons for Elementor plugin represents a critical stored cross-site scripting flaw that affects versions up to 2.9.1, creating significant security risks for WordPress installations. This weakness specifically targets the Navigation Menu Widget functionality where data-toggle-icon and data-close-icon attributes are processed without adequate sanitization measures. The vulnerability stems from insufficient input validation and output escaping mechanisms within the plugin's codebase, allowing malicious actors to inject harmful scripts that persist in the database and execute whenever affected pages are accessed.
Attackers with contributor-level privileges or higher can exploit this weakness by crafting malicious payloads that leverage the data- attributes within the navigation menu widget configuration. The security flaw occurs because wp_kses_post function, which is designed to sanitize content for users without unfiltered_html capabilities, fails to properly neutralize HTML-entity-encoded payloads that are stored within data- attributes of kses-allowed elements. This creates a bypass where the browser automatically decodes these encoded values client-side before jQuery .html() processes them as markup, effectively rendering the sanitization measures ineffective.
The operational impact of this vulnerability extends beyond simple script execution, potentially enabling attackers to perform session hijacking, deface websites, steal sensitive user data, or redirect visitors to malicious sites. Since the attack requires only contributor-level access, it represents a particularly dangerous weakness that could be exploited by insiders or compromised users with relatively low privileges. The stored nature of the vulnerability means that once injected, malicious scripts will execute automatically for any user who accesses pages containing the compromised navigation menu widgets, creating a persistent threat vector.
Organizations should immediately update to versions beyond 2.9.1 where this vulnerability has been addressed, while implementing additional mitigations such as restricting contributor access to plugin settings and conducting thorough security audits of existing content. The vulnerability aligns with CWE-79 (Cross-Site Scripting) and maps to ATT&CK technique T1566.002 (Phishing via Service) as it enables attackers to create malicious navigation elements that can be used for social engineering campaigns. Security teams should also consider implementing Content Security Policy headers and monitoring for unusual plugin modifications to detect potential exploitation attempts before they occur.