CVE-2026-8354: Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poptag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site and have Contributor-level access or higher. No user interaction is required from the attacker after they save the malicious widget setting.
What happens when the vulnerability is exploited?
An attacker can place arbitrary web script in the pop_tag widget setting. The script executes in the browsers of users who visit the affected page.
Which installations are affected?
Gum Addon for Elementor versions through 1.3.15 are affected. The issue is in the plugin's pop_tag parameter.
How can I determine whether my site may already be affected?
Review pages using the plugin's popover button widget and inspect the pop_tag setting for unexpected markup or script content. Also review Contributor and higher-privileged account activity for unauthorized page or widget edits.