CVE-2026-8354 in Gum Addon for Elementor Plugin
Summary
by MITRE • 09/19/2026
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The Gum Addon for Elementor plugin is a widely used extension within the WordPress ecosystem designed to enhance website design capabilities through additional widgets and functionality. A critical security flaw has been identified in versions up to 1.3.15, specifically involving stored cross-site scripting vulnerabilities associated with the pop_tag parameter. This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the plugin codebase. When users interact with features that utilize this parameter, such as configuring popup tags or related settings, the application fails to adequately validate or encode user-supplied data before storing it in the database. Consequently, malicious actors can inject arbitrary JavaScript payloads into these fields during normal administrative operations.
The operational impact of this vulnerability is significant because it allows authenticated attackers with contributor-level access and above to execute arbitrary web scripts within the context of other users' browsers. Unlike reflected cross-site scripting where the payload must be delivered via a link, stored XSS persists on the server side. This means that every time an administrator or another user views the affected page containing the injected script, the malicious code executes automatically. Attackers can leverage this capability to steal session cookies, hijack administrative accounts, deface websites, or redirect users to phishing sites. The requirement for contributor-level access lowers the barrier for exploitation compared to vulnerabilities requiring full administrator privileges, thereby increasing the potential attack surface within multi-author WordPress environments where lower-privileged users may have legitimate editing rights but should not possess the ability to inject persistent malicious code.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing the payload for later execution categorizes it under stored XSS rather than reflected or DOM-based variants. In terms of threat modeling and adversary behavior mapping according to MITRE ATT&CK framework, this vulnerability facilitates techniques related to Collection via Browser Hijacking and Credential Access through Stealing Web Session Cookies. Attackers can use these capabilities to maintain persistence within the compromised WordPress installation by creating backdoors or exfiltrating sensitive data from authenticated sessions. The lack of proper output escaping means that even if input validation is partially implemented, the final rendering phase fails to neutralize special characters such as angle brackets and quotes, allowing script tags to be interpreted by the browser rather than displayed as plain text.
Mitigation strategies for this vulnerability involve immediate remediation through software updates or manual code patching. Users running versions up to 1.3.15 should upgrade to a patched version where the developers have implemented robust input sanitization using functions like wp_kses_post or similar WordPress-specific escaping mechanisms, and ensured that output is properly escaped before rendering in HTML contexts. If an update is not immediately available, administrators can mitigate risk by restricting contributor-level access to trusted individuals only and monitoring user activity logs for suspicious behavior. Additionally implementing a Web Application Firewall with rules capable of detecting and blocking XSS payloads in POST requests can provide a layer of defense against exploitation attempts while the underlying code issue is resolved. Regular security audits and adherence to secure coding practices that emphasize validation at entry points and escaping at output points are essential preventive measures against such vulnerabilities in future development cycles.