CVE-2026-9243 in The Plus Addons for Elementor Plugin
Summary
by MITRE • 05/29/2026
The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/31/2026
The vulnerability in the Plus Addons for Elementor plugin represents a critical stored cross-site scripting flaw that affects WordPress environments using versions up to and including 6.4.15. This security weakness specifically targets the Carousel Anything widget within the plugin's functionality, creating a persistent threat vector that can be exploited by authenticated attackers possessing contributor-level privileges or higher. The vulnerability stems from inadequate output sanitization practices during the rendering process, where user-supplied input fails to receive proper escaping before being embedded into HTML attributes.
The technical implementation flaw occurs within the render() function of the Carousel Anything widget where the carousel_direction parameter is improperly handled. Despite the use of esc_attr() for output escaping, the vulnerability persists because the parameter value is inserted into an unquoted HTML attribute using the dir= syntax without proper HTML attribute value escaping. This creates an attribute injection scenario where malicious script code can be injected into the HTML attribute and subsequently executed in the browser context of unsuspecting users. The vulnerability maps to CWE-79: Improper Neutralization of Input During Web Page Generation, which specifically addresses XSS conditions arising from insufficient output escaping in web applications.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to perform various malicious activities including session hijacking, data theft, and redirection to malicious sites. Authenticated attackers with contributor-level access can inject persistent scripts that will execute whenever any user accesses pages containing the vulnerable carousel widget, making this a particularly dangerous threat vector. The vulnerability affects all users who view pages with the affected carousel functionality, potentially compromising a large user base within a WordPress installation. This type of vulnerability aligns with ATT&CK technique T1566.001: Phishing: Spearphishing Attachment, as attackers can leverage this vulnerability to deliver malicious payloads through crafted carousel configurations that appear legitimate to end users.
Mitigation strategies should include immediate patching to version 6.4.16 or later, which addresses the output escaping issue in the render() function. Administrators should also implement strict access controls limiting contributor-level privileges to trusted users only, as well as monitoring for unauthorized modifications to carousel widget configurations. Additionally, implementing Content Security Policy headers can provide defense-in-depth protection against script execution, while regular security audits of plugin configurations should be conducted to identify similar output escaping vulnerabilities in other components. The vulnerability demonstrates the critical importance of proper input validation and output escaping in web applications, particularly when handling user-supplied data in HTML attribute contexts where traditional escaping mechanisms may prove insufficient.