CVE-2026-15156: Essential Addons Elementor XSS Vulnerability

CVE-2026-15156 Overview

CVE-2026-15156 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. The flaw affects all versions up to and including 6.6.11 and resides in the Reading Progress Global Color Settings feature. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who accesses the affected page. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can persist malicious JavaScript that runs against site visitors and administrators, enabling session theft, account takeover, and drive-by redirection.

Affected Products

Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress
All plugin versions up to and including 6.6.11
WordPress sites using the Reading Progress widget with Global Color Settings

Discovery Timeline

2026-07-21 - CVE-2026-15156 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15156

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the Reading Progress widget's Global Color Settings. The plugin accepts color configuration data from authenticated users and stores it in the WordPress database. When the widget is rendered, the stored values are echoed into the page output without adequate sanitization or escaping. This allows an attacker with contributor-level privileges to embed arbitrary HTML and JavaScript payloads inside the color settings fields. The stored payload executes in the context of the site's origin whenever another user, including administrators, views a page containing the affected widget. Because the CVSS scope is changed, exploitation can affect resources beyond the vulnerable component, such as the WordPress admin dashboard.

Root Cause

The root cause is missing input validation on the server side combined with the absence of context-aware output escaping when rendering global color values. Trusted rendering paths in the plugin's includes/Traits/Elements.php and related bootstrap classes emit stored settings directly into inline styles or attributes. When a color parameter contains script content instead of a valid CSS color, the browser parses it as executable markup.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or above on a WordPress site running a vulnerable plugin version. The attacker edits a page using the Reading Progress widget and supplies a crafted value in the Global Color Settings input. The payload persists in post metadata. When any user, including an administrator, previews or visits the page, the browser executes the injected JavaScript. This can be leveraged to hijack sessions, exfiltrate authentication cookies, perform CSRF against administrative endpoints, or plant persistent backdoor accounts.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report and the WordPress Changeset Analysis for the corrective code changes introduced upstream.

Detection Methods for CVE-2026-15156

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in wp_postmeta entries associated with Elementor widget data.
Outbound requests from browsers viewing WordPress pages to unfamiliar domains hosting attacker-controlled JavaScript.
New administrator accounts or modified user roles created shortly after a contributor edits a page containing the Reading Progress widget.
Log entries showing contributor-level users editing pages with anomalous color values containing HTML control characters.

Detection Strategies

Audit posts and post meta for the Essential Addons Reading Progress widget and inspect stored color values for non-CSS content.
Deploy a web application firewall rule that flags requests to Elementor save endpoints containing <, >, or on*= patterns in color parameters.
Monitor WordPress activity logs for privilege escalation events, user role modifications, and unexpected file uploads following page edits by lower-privileged users.

Monitoring Recommendations

Enable Content Security Policy reporting to identify script-src violations from injected payloads.
Alert on any file changes under wp-content/plugins/essential-addons-for-elementor-lite/ and on new administrative users created outside change windows.
Correlate browser telemetry from administrators with editorial activity to identify suspected drive-by execution against admin sessions.

How to Mitigate CVE-2026-15156

Immediate Actions Required

Update the Essential Addons for Elementor plugin to a version newer than 6.6.11 that includes the fix shipped in the 6.7.0 branch.
Review all contributor, author, and editor accounts and remove any that are unused, inactive, or unrecognized.
Inspect existing pages that use the Reading Progress widget and sanitize or remove any color settings containing non-color content.
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected.

Patch Information

The issue is remediated upstream in the plugin's 6.7.0 branch. Review the WordPress Version Changes Overview and the WordPress Changeset Analysis for the specific code changes that add input sanitization and output escaping to the Reading Progress global color handling logic.

Workarounds

Restrict who can create or edit posts by limiting contributor-level and higher accounts to trusted users only.
Disable the Reading Progress widget in the plugin settings until the site is upgraded to a patched version.
Deploy a WAF rule that rejects Elementor save requests where widget color fields contain characters outside the expected hex or rgb()/rgba() grammar.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted external script sources.

bash

# Update the plugin via WP-CLI to a fixed version
wp plugin update essential-addons-for-elementor-lite --version=6.7.0

# Verify the installed version
wp plugin get essential-addons-for-elementor-lite --field=version

# Audit post meta for suspicious stored payloads
wp db query "SELECT post_id, meta_key FROM wp_postmeta \
  WHERE meta_value LIKE '%<script%' \
     OR meta_value LIKE '%onerror=%' \
     OR meta_value LIKE '%javascript:%';"