WordPress Plugin Vulnerabilities

Essential Addons for Elementor < 6.7.0 - Contributor+ Stored Cross-Site Scripting via Fancy Text Widget

Description

The plugin does not sanitise and escape some of the Fancy Text widget settings, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Affects Plugins

Plugin icon
essential-addons-for-elementor-lite
Fixed in 6.7.0

References

CVE
CVE-2026-15145
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2100d720-bfb4-451d-9907-e0b77ef507a5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Asaf Mozes
Verified
No
WPVDB ID
0b77eb19-9ea8-4935-9497-07dfd6fad3ab

Timeline

Publicly Published
2026-07-20 (about 1 month ago)
Added
2026-07-20 (about 1 month ago)
Last Updated
2026-07-20 (about 1 month ago)

Other

Published
Title
Published
2014-08-01
Title
Broadscope - Unspecified XSS
Published
2014-08-01
Title
click-to-copy-grab-box <= 0.1.1 - XSS in ZeroClipboard
Published
2025-03-19
Title
custom-post-edit <= 1.0.4 - Reflected Cross-Site Scripting
Published
2026-08-12
Title
PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2024-03-26
Title
Elementor Website Builder Pro < 3.20.2 - Authententicated (Contributor+) Stored Cross-Site Scripting