WordPress Plugin Vulnerabilities

CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

Description

The plugin does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.

Proof of Concept

Affects Plugins

Plugin icon
crt-manage
Fixed in 1.6.7

References

CVE
CVE-2026-11767

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
hitarth shah
Submitter
hitarth shah
Submitter website
https://hitarth-shah.framer.website/
Submitter twitter
hitsovercli
Verified
Yes
WPVDB ID
e06a6497-e44f-43b9-b6ba-407aea171387

Timeline

Publicly Published
2026-06-30 (about 22 days ago)
Added
2026-06-30 (about 22 days ago)
Last Updated
2026-07-20 (about 1 day ago)

Other

Published
Title
Published
2024-06-11
Title
Events Addon for Elementor < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2025-03-21
Title
Newsletters < 4.9.9.8 - Reflected Cross-Site Scripting via To Parameter
Published
2026-06-02
Title
Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
Published
2021-03-28
Title
Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2026-05-29
Title
WPComplete < 2.9.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting