CVE-2026-15787: Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wpksespost, applied on save for users without unfilteredhtml, does not neutralize HTML-entity-encoded payloads stored inside data- attributes on kses-allowed elements, as the browser decodes these values client-side before jQuery .html() renders them as markup.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15787?
The severity of CVE-2026-15787 is medium with a score of 6.4.
How do I fix CVE-2026-15787?
To fix CVE-2026-15787, update the Ultimate Addons for Elementor plugin to a version greater than 2.9.1.
What type of vulnerability is CVE-2026-15787?
CVE-2026-15787 is a stored cross-site scripting (XSS) vulnerability.
What causes CVE-2026-15787?
CVE-2026-15787 is caused by insufficient input sanitization and output escaping in the Navigation Menu Widget.
What versions are affected by CVE-2026-15787?
All versions of the Ultimate Addons for Elementor plugin up to and including 2.9.1 are affected by CVE-2026-15787.