CVE-2026-15145: Essential Addons for Elementor XSS Flaw

CVE-2026-15145 Overview

CVE-2026-15145 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. The flaw affects all versions up to and including 6.6.11 and resides in the Fancy Text Widget. Insufficient input sanitization and output escaping on the animation attribute allow authenticated attackers with contributor-level access or above to inject arbitrary JavaScript. The injected payload executes in the browser of any visitor who accesses the affected page.

Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes against every visitor, enabling session theft, redirection, and administrative account takeover.

Affected Products

Essential Addons for Elementor – Popular Elementor Templates & Widgets (WordPress plugin)
All versions up to and including 6.6.11
Fixed in version 6.7.0

Discovery Timeline

2026-07-21 - CVE-2026-15145 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15145

Vulnerability Analysis

The vulnerability exists in the Fancy Text Widget shipped with Essential Addons for Elementor. The widget uses the bundled Morphext jQuery library to cycle animated phrases inside an element. The animate function in assets/front-end/js/lib-view/morphext/morphext.js concatenates the widget's animation setting directly into an innerHTML assignment without escaping. Because the animation value is derived from user-controlled widget settings, a contributor authoring a page can break out of the class attribute and inject arbitrary HTML and script content. The malicious markup is persisted with the post and rendered to every subsequent visitor.

Root Cause

The root cause is unsafe DOM construction using innerHTML with untrusted string concatenation. The original code built the animated span as "<span class=\"animated " + this.settings.animation + "\">" + this.phrases[this.index] + "</span>", allowing quote-breaking payloads in settings.animation to inject attributes or child elements including <script> and onerror handlers.

Attack Vector

An authenticated user with contributor privileges or higher edits a page and inserts a Fancy Text Widget. The attacker sets the animation field to a payload that terminates the class attribute and injects an event handler or script tag. When any visitor loads the page, the Morphext animate routine writes the payload into the DOM and the browser executes it. This yields stored XSS in the site owner's origin, enabling privilege escalation if an administrator views the page.

javascript

// Patched animate() in morphext.js — sanitizes animation names in FancyText
// to prevent injection vulnerabilities (CVE-2026-15145)
animate: function () {
    this.index = ++this.index % this.phrases.length;

    // Build the animated span without innerHTML so neither the animation
    // class nor the phrase text can inject markup (CVE-2026-15145).
    var span = document.createElement("span");
    span.className = "animated";
    String(this.settings.animation || "").split(/\s+/).forEach(function (cls) {
        if (cls) {
            span.classList.add(cls);
        }
    });
    span.textContent = this.phrases[this.index];

    this.element[0].textContent = "";
    this.element[0].appendChild(span);

    if ($.isFunction(this.settings.complete)) {
        this.settings.complete.call(this);
    }
}
// Source: https://github.com/wpdevelopers/essential-addons-for-elementor-lite/commit/d88e08257

Detection Methods for CVE-2026-15145

Indicators of Compromise

Fancy Text Widget instances whose animation setting contains characters such as ", <, >, =, or the string on followed by event handler names like onerror or onload.
Outbound requests from visitor browsers to unfamiliar domains shortly after rendering pages that embed the Fancy Text Widget.
Post metadata rows in wp_postmeta referencing eael-fancy-text widgets with unusual payload strings in the animation property.

Detection Strategies

Audit post revisions and Elementor page data for Fancy Text Widget entries created or modified by contributor and author accounts.
Deploy a web application firewall rule that inspects Elementor widget save requests for HTML metacharacters within the animation parameter.
Scan rendered pages for <span class="animated ..."> fragments whose class attribute contains quotes, angle brackets, or inline event handlers.

Monitoring Recommendations

Monitor the WordPress activity log for contributor or author accounts that create or edit pages containing Fancy Text Widgets.
Alert on unexpected administrator session activity, new administrative user creation, or plugin installation immediately following page views.
Track outbound HTTP requests from browsers loading pages that use Essential Addons widgets to identify script beacons to attacker-controlled hosts.

How to Mitigate CVE-2026-15145

Immediate Actions Required

Update Essential Addons for Elementor to version 6.7.0 or later on all WordPress installations.
Review all existing Fancy Text Widget instances and remove or sanitize any suspicious animation values.
Audit contributor, author, and editor accounts, and reset credentials for any account with unexplained activity.

Patch Information

The vendor fixed the vulnerability in Essential Addons for Elementor version 6.7.0. The patch replaces the unsafe innerHTML concatenation with document.createElement, classList.add, and textContent assignments so animation class names and phrase text cannot inject markup. Review the GitHub commit d88e08257 and the WordPress changeset comparison for 6.6.11 to 6.7.0 for the full diff. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

Restrict contributor and author role assignments to trusted users until the plugin is upgraded.
Temporarily disable the Fancy Text Widget or the Essential Addons for Elementor plugin on sites that cannot patch immediately.
Enforce a strict Content Security Policy that blocks inline scripts and untrusted script sources to limit XSS impact.

bash

# Update Essential Addons for Elementor using WP-CLI
wp plugin update essential-addons-for-elementor-lite --version=6.7.0

# Verify installed version
wp plugin get essential-addons-for-elementor-lite --field=version