CVE-2026-15285: Elementor Plus Addons XSS Vulnerability

CVE-2026-15285 Overview

CVE-2026-15285 is a stored Cross-Site Scripting (XSS) vulnerability in The Plus Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 6.4.11 and resides in the Button widget's custom_attributes setting. The render function in modules/widgets/tp_button.php passes the raw custom_attributes value through a tp_senitize_js_input() filter that attackers can bypass. Authenticated users with Contributor-level privileges or higher can inject malicious JavaScript that executes in visitors' browsers. The vendor patched the issue in version 6.4.12.

Critical Impact
Contributor-level users can store JavaScript payloads in Button widgets that execute when administrators or site visitors view the affected pages, enabling session theft and account takeover.

Affected Products

The Plus Addons for Elementor plugin for WordPress, versions up to and including 6.4.11
WordPress sites running the vulnerable plugin with Contributor or higher user roles enabled
Fixed in The Plus Addons for Elementor version 6.4.12

Discovery Timeline

2026-07-10 - CVE-2026-15285 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15285

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79]. It occurs in the Button widget's rendering logic within modules/widgets/tp_button.php. When Elementor renders a Button element, the plugin reads the custom_attributes value supplied by the content author and outputs it into the DOM as HTML attributes. The plugin attempts to sanitize this value using an internal helper called tp_senitize_js_input(), defined in modules/helper-function.php. This filter fails to strip or neutralize all script-execution vectors, allowing crafted attribute payloads to pass through unaltered.

Because the payload is persisted in the WordPress database, every visitor who loads the affected page triggers execution in their browser context. The attack requires only Contributor-level authentication, a low privilege bar on multi-author WordPress sites.

Root Cause

The root cause is insufficient input sanitization in tp_senitize_js_input(). The helper applies incomplete filtering logic that does not account for event handler attributes, encoded payloads, or attribute-context escape sequences. The render function then emits the value directly into HTML output without additional escaping such as esc_attr() or a strict allowlist of permitted attribute names.

Attack Vector

An attacker with Contributor privileges creates or edits a post containing an Elementor Button widget. They inject a JavaScript payload into the widget's custom_attributes field, submit the post for review, and wait for an editor or administrator to preview or publish the content. When the page renders, the injected script runs with the victim's session, enabling cookie theft, forced administrative actions, or persistent backdoor installation via plugin upload.

The vulnerability manifests through the bypassable tp_senitize_js_input() filter chain. Refer to the Wordfence Vulnerability Report and the patched code in version 6.4.12 for the corrected sanitization logic.

Detection Methods for CVE-2026-15285

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_postmeta rows tied to Elementor Button widgets
Outbound HTTP requests from browser sessions to unfamiliar domains after loading pages built with The Plus Addons Button widget
New administrator accounts or plugin installations created shortly after a Contributor-level user edited Elementor content
Elementor page data containing suspicious values in custom_attributes fields of tp-button widgets

Detection Strategies

Audit the WordPress database for Elementor widget definitions containing script-execution keywords such as onerror, onload, onclick, or javascript: inside custom_attributes
Review WordPress user activity logs for Contributor and Author accounts editing pages that use The Plus Addons Button widgets
Compare deployed plugin file hashes against the official 6.4.12 release to confirm patch application
Monitor Content Security Policy (CSP) violation reports for inline script executions on Elementor-rendered pages

Monitoring Recommendations

Enable WordPress audit logging plugins to record post revisions, user role changes, and plugin installations
Forward web server access logs and WordPress logs to a centralized SIEM for correlation of post edits with subsequent administrative activity
Alert on any HTTP responses that echo attacker-controlled attribute content into Button widget output
Track privilege escalations and new admin account creation events following Contributor content submissions

How to Mitigate CVE-2026-15285

Immediate Actions Required

Update The Plus Addons for Elementor to version 6.4.12 or later on all WordPress installations
Audit existing Elementor content for malicious custom_attributes values in Button widgets and remove any suspicious entries
Review Contributor, Author, and Editor accounts for unauthorized users and reset credentials where necessary
Rotate WordPress administrator passwords and invalidate active sessions if injection is confirmed

Patch Information

The vendor released version 6.4.12 of The Plus Addons for Elementor, which rewrites the sanitization applied to custom_attributes in modules/widgets/tp_button.php. Refer to the patched code in version 6.4.12 and the vulnerable code in version 6.4.11 for diff analysis.

Workarounds

Restrict Contributor and Author roles from editing Elementor content until the patched version is deployed
Deploy a Web Application Firewall (WAF) rule that blocks HTML event handler attributes and javascript: URIs in POST requests to admin-ajax.php and Elementor save endpoints
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on public pages rendered by Elementor
Temporarily disable The Plus Addons for Elementor plugin if the update cannot be applied immediately

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update the-plus-addons-for-elementor-page-builder --version=6.4.12
wp plugin get the-plus-addons-for-elementor-page-builder --field=version