CVE-2026-1397: PQ Addons Elementor Plugin XSS Vulnerability

CVE-2026-1397 Overview

CVE-2026-1397 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the PQ Addons – Creative Elementor Widgets plugin for WordPress. The flaw exists in all versions up to and including 1.0.0. It results from insufficient input sanitization and output escaping on the html_tag parameter within the PQ Section Title widget. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who visits an affected page, enabling session theft, redirection, or content manipulation under the site's origin.

Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, executing in the context of any visitor including administrators.

Affected Products

PQ Addons – Creative Elementor Widgets plugin for WordPress
All versions through 1.0.0
WordPress sites using the PQ Section Title widget

Discovery Timeline

2026-03-21 - CVE-2026-1397 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1397

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. The PQ Section Title widget accepts an html_tag parameter intended to control the HTML element wrapping the section title. The plugin renders this parameter directly into page output without proper sanitization or escaping. A contributor-level user can craft widget content where html_tag contains attacker-controlled markup or attributes that break out of the intended tag context. The injected payload persists in the post or page content and executes whenever the page loads in a visitor's browser. Because the script runs in the site's origin, it can read cookies not marked HttpOnly, perform actions on behalf of authenticated viewers, and pivot toward administrator account takeover.

Root Cause

The root cause is missing input sanitization on widget save and missing output escaping on render for the html_tag parameter. The vulnerable code paths reside in widgets/section-title/styles/style-1.php and widgets/section-title/styles/style-2.php, where the parameter is emitted into HTML without functions such as tag_escape() or a server-side allowlist of permitted tag names. See the WordPress Widget Style 1 Code and WordPress Widget Style 2 Code for the exact lines.

Attack Vector

An attacker requires an authenticated WordPress account with contributor privileges or higher. The attacker edits a post or page, adds the PQ Section Title widget, and supplies a malicious value for the html_tag field. Once the post is published or previewed by another user, the script executes in that user's browser session. Refer to the Wordfence Vulnerability Analysis for additional exploitation context. No verified public proof-of-concept code is referenced in the advisory data.

Detection Methods for CVE-2026-1397

Indicators of Compromise

Unexpected <script> tags, event handler attributes (onerror, onload), or javascript: URIs inside wp_posts.post_content referencing the PQ Section Title widget.
Outbound browser requests from authenticated admin sessions to unfamiliar domains shortly after viewing a contributor-authored page.
Newly created administrator accounts or modified user roles following contributor activity.

Detection Strategies

Audit the wp_posts table for serialized Elementor widget data containing html_tag values that are not in the allowed list (h1–h6, div, span, p).
Review WordPress audit logs for contributor-level users creating or editing posts that include PQ Addons widgets.
Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on rendered pages.

Monitoring Recommendations

Monitor web server access logs for anomalous POST requests to /wp-admin/admin-ajax.php carrying Elementor save actions from low-privilege accounts.
Track changes to user roles and capabilities, especially privilege escalations occurring after page previews.
Forward WordPress and web server telemetry to a centralized logging platform for correlation against contributor authoring activity.

How to Mitigate CVE-2026-1397

Immediate Actions Required

Update the PQ Addons – Creative Elementor Widgets plugin to a version newer than 1.0.0 once the vendor releases a patched release.
Audit existing posts and pages for malicious html_tag values and remove or sanitize affected widget instances.
Restrict the contributor role from using the PQ Section Title widget until a fix is verified.

Patch Information

At the time of NVD publication, all versions up to and including 1.0.0 are affected. Site administrators should monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Analysis advisory for patch availability and apply updates promptly.

Workarounds

Deactivate and remove the PQ Addons – Creative Elementor Widgets plugin until a patched version ships.
Apply a Web Application Firewall (WAF) rule that blocks requests containing script-injection patterns in Elementor widget payloads.
Tighten role assignments so untrusted users do not hold contributor or higher capabilities on production sites.
Implement a strict Content Security Policy that disallows inline scripts and unauthorized event handlers.

bash

# Example WordPress CLI commands to deactivate the vulnerable plugin
wp plugin deactivate peacefulqode-elementzplus-widgets
wp plugin delete peacefulqode-elementzplus-widgets