CVE-2026-15787 Overview
CVE-2026-15787 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Addons for Elementor plugin for WordPress, distributed as header-footer-elementor. The flaw affects all versions up to and including 2.9.1 and resides in the Navigation Menu Widget's handling of the data-toggle-icon and data-close-icon attributes. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when any user views the affected page. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level users can persist JavaScript payloads that execute in the browser context of every visitor, enabling session theft, administrative action forgery, and site defacement.
Affected Products
- Ultimate Addons for Elementor (header-footer-elementor) — versions up to and including 2.9.1
- Fixed in version 2.9.2
- WordPress sites running the plugin with contributor-or-higher user registration enabled
Discovery Timeline
- 2026-07-22 - CVE-2026-15787 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-15787
Vulnerability Analysis
The vulnerability exists in the Navigation Menu Widget shipped with the Ultimate Addons for Elementor plugin. Contributors and higher-privileged users can set values for the data-toggle-icon and data-close-icon attributes when configuring the widget. On save, WordPress applies wp_kses_post for users lacking the unfiltered_html capability. That filter permits standard data-* attributes on kses-allowed elements and does not decode HTML-entity-encoded content inside those attributes.
The stored value survives sanitization in encoded form. When the frontend script inc/js/frontend.js runs on the rendered page, jQuery reads the attribute and passes it to .html() at lines 682, 684, 701, and 703. The browser decodes the HTML entities during attribute retrieval, and .html() then parses the resulting string as HTML markup, executing any injected <script> or event-handler payloads. The scope change (S:C) indicates the injected script executes in the site's origin, impacting visitors beyond the attacker's own privilege boundary.
Root Cause
The root cause is a mismatch between server-side sanitization semantics and client-side DOM rendering. wp_kses_post treats HTML entities inside data-* attributes as inert text, but the plugin's jQuery code later interprets the decoded attribute value as HTML through .html(). Neither output escaping at render time nor safe DOM APIs such as .text() are used.
Attack Vector
An authenticated attacker with contributor privileges creates or edits a page containing a Navigation Menu Widget. The attacker injects an HTML-entity-encoded payload such as <img src=x onerror=...> into the data-toggle-icon or data-close-icon attribute. Upon publication or preview, any visitor loading the page triggers the jQuery .html() call, decoding and executing the payload in the site's browser context.
See the Wordfence Vulnerability Report #39f26d35 and the vulnerable code paths in frontend.js line 682 (v2.9.1) for technical detail.
Detection Methods for CVE-2026-15787
Indicators of Compromise
- Navigation Menu Widget instances containing HTML-entity sequences such as <, >, <, or < inside data-toggle-icon or data-close-icon attribute values in wp_postspost_content or Elementor _elementor_data postmeta.
- Outbound requests from site visitors to attacker-controlled domains following page loads containing the plugin's hfe-nav-menu markup.
- Unexpected inline event handlers (onerror, onload, onmouseover) inside menu widget serialized JSON.
- New contributor or author accounts created shortly before content modifications to pages using the widget.
Detection Strategies
- Query the WordPress database for stored posts and postmeta whose Elementor data contains data-toggle-icon or data-close-icon alongside HTML entity patterns.
- Deploy web application firewall rules that inspect and block POST requests to admin-ajax.php and the REST API wp/v2/pages endpoint containing entity-encoded angle brackets within Elementor widget payloads.
- Monitor rendered pages with a headless browser and flag DOM mutations that introduce <script> nodes originating from .hfe-nav-menu containers.
Monitoring Recommendations
- Audit contributor, author, and editor account activity, correlating page saves with subsequent visitor traffic spikes.
- Enable and review WordPress content revisions to detect unauthorized modifications to Navigation Menu Widget attributes.
- Alert on Content Security Policy violation reports referencing inline scripts inside plugin-generated menu markup.
How to Mitigate CVE-2026-15787
Immediate Actions Required
- Upgrade the Ultimate Addons for Elementor plugin (header-footer-elementor) to version 2.9.2 or later on all WordPress installations.
- Review the list of users with contributor or higher roles and remove untrusted accounts pending remediation.
- Scan existing pages and posts for malicious payloads stored in Navigation Menu Widget data-* attributes and purge affected content.
- Rotate administrator session cookies and credentials if evidence of exploitation is found.
Patch Information
The vendor addressed the flaw in version 2.9.2 of header-footer-elementor. See WordPress Changeset #3614409 and the diff between 2.9.1 and 2.9.2 for the corrected rendering logic that avoids passing decoded attribute values to jQuery .html().
Workarounds
- Restrict the Navigation Menu Widget to trusted administrator accounts until the patch is applied.
- Disable contributor and author self-registration (Settings → General → Membership) and require editorial review before publishing.
- Deploy a Content Security Policy that forbids inline scripts (script-src 'self') to reduce impact of stored XSS payloads.
- Apply WAF rules that strip HTML entities from data-toggle-icon and data-close-icon request parameters targeting Elementor endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
