Description
The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.
Published: 2026-07-10
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Plus Addons for Elementor plugin allows a user with Contributor or higher privileges to store arbitrary JavaScript in the "custom_attributes" field of the Button widget. During rendering the plugin passes this raw input through a bypassable filter, resulting in a stored cross‑site scripting flaw that aligns with CWE‑79. An attacker can inject malicious code that executes in the browsers of every visitor to the affected page.

Affected Systems

WordPress sites that use The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin until and including version 6.4.11 are impacted. The flaw is resolved in 6.4.12.

Risk and Exploitability

Exploitation requires authenticated access with at least Contributor rights via the plugin's admin interface; no remote network entry is required. The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% coupled with the absence from the CISA KEV catalog suggests no current active exploitation has been observed, though the vulnerability remains viable.

Generated by OpenCVE AI on August 1, 2026 at 13:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Plus Addons for Elementor plugin to version 6.4.12 or later to eliminate the vulnerable code path.
  • Identify and remove any stale custom_attributes data that may contain malicious scripts—clean the database entries or use the plugin’s editor to clear the field.
  • Restrict Contributor roles to only the permissions required for their duties and disable or limit the custom_attributes feature via plugin settings or a custom hook until a hardened patch is available.

Generated by OpenCVE AI on August 1, 2026 at 13:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Description The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.
Title The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-10T14:02:54.137Z

Reserved: 2026-07-09T15:49:35.073Z

Link: CVE-2026-15285

cve-icon Vulnrichment

Updated: 2026-07-10T14:02:47.232Z

cve-icon NVD

Status : Deferred

Published: 2026-07-10T05:16:31.210

Modified: 2026-07-10T15:43:30.330

Link: CVE-2026-15285

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T13:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')