CVE-2026-77150: Unlimited Elements For Elementor XSS Vulnerability

CVE-2026-77150 Overview

CVE-2026-77150 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Unlimited Elements For Elementor plugin for WordPress. The flaw affects all versions up to and including 2.0.16. Unauthenticated attackers can inject arbitrary web scripts through the data[name] parameter due to insufficient input sanitization and output escaping. The vulnerable show_preview AJAX action is registered for unauthenticated users and gated only by a nonce, which any visitor can obtain from a public page. Successful exploitation requires tricking a user into clicking a crafted link, at which point the injected script executes in the victim's browser context [CWE-79].

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or admin account takeover if an authenticated administrator clicks the link.

Affected Products

Unlimited Elements For Elementor (WordPress plugin) - all versions through 2.0.16
WordPress installations with the vulnerable plugin activated
Sites exposing the show_preview AJAX endpoint to unauthenticated visitors

Discovery Timeline

2026-09-11 - CVE-2026-77150 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-77150

Vulnerability Analysis

The vulnerability resides in the plugin's show_preview AJAX handler, which processes the data[name] request parameter without sufficient sanitization or contextual output escaping. When the plugin reflects the attacker-controlled value back into an HTML response, browser interpretation of the injected payload results in script execution. Because the endpoint is registered via wp_ajax_nopriv_, no authentication is required to invoke it. The nonce protection is not a security boundary here: the required nonce is emitted on publicly accessible pages, so an unauthenticated attacker can programmatically fetch it before submitting the malicious request.

Root Cause

The root cause is missing input sanitization and missing output escaping when handling the data[name] parameter inside the AJAX flow. WordPress provides helper functions such as sanitize_text_field() and esc_html() for these use cases, but neither is applied consistently along the code path referenced in the plugin's action and provider classes. Refer to the WordPress Plugin Action Class Source and the WordPress Plugin Admin Provider Source for the affected functions.

Attack Vector

Exploitation follows a predictable pattern. The attacker first loads any public page on the target site to harvest the nonce embedded in the HTML. Next, the attacker crafts a URL or form that submits the show_preview AJAX request with a malicious payload in data[name] and the captured nonce. The attacker then delivers this link through phishing, forum posts, or social media. When a victim clicks it, the reflected payload executes in the victim's browser under the site's origin. If the victim is an authenticated administrator, the attacker can perform privileged actions such as creating new admin accounts or modifying plugin settings.

See the Wordfence Vulnerability Report and the WordPress Plugin Change Set Details for the applied fix diff.

Detection Methods for CVE-2026-77150

Indicators of Compromise

HTTP POST or GET requests to admin-ajax.php with action=show_preview from unauthenticated sources containing <script>, onerror=, onload=, or javascript: substrings in the data[name] parameter.
Requests to public pages immediately followed by AJAX calls to show_preview from the same client IP, indicating nonce harvesting.
Unexpected admin user creation, plugin installations, or option changes originating from administrator sessions shortly after external link clicks.

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying action=show_preview combined with URL-encoded HTML or JavaScript payloads in data[name].
Deploy Web Application Firewall (WAF) rules that block or alert on script tags, event handlers, and encoded XSS payloads submitted to the plugin's AJAX endpoints.
Correlate referer headers with request patterns to identify off-site link clicks that immediately trigger the vulnerable endpoint.

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions, especially user role changes and plugin file modifications.
Monitor outbound requests from browsers on admin sessions for connections to attacker-controlled callback domains typical of XSS data exfiltration.
Track anomalies in the volume of show_preview AJAX calls, which typically originate from editors rather than anonymous visitors.

How to Mitigate CVE-2026-77150

Immediate Actions Required

Update the Unlimited Elements For Elementor plugin to the version released after 2.0.16 that contains the fix referenced in the WordPress plugin changeset.
If immediate patching is not possible, deactivate the plugin until the update can be applied and validated in a staging environment.
Invalidate active administrator sessions and force password resets for privileged users on sites that have been publicly exposed.

Patch Information

The vendor released a corrected version of the plugin that adds sanitization and escaping to the show_preview AJAX handler. The applied changes are visible in the WordPress Plugin Change Set Details. Administrators should upgrade to the latest available release through the WordPress plugin dashboard and confirm the installed version is greater than 2.0.16.

Workarounds

Add WAF rules that reject requests to admin-ajax.php with action=show_preview containing HTML tags, event handlers, or JavaScript URI schemes in query parameters.
Restrict access to admin-ajax.php by IP allowlist for privileged operations where feasible, reducing the attack surface for anonymous AJAX abuse.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and limits script sources to trusted origins to reduce the impact of reflected payloads.

bash

# Example ModSecurity rule to block XSS payloads targeting the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1077150,phase:2,deny,status:403,log,msg:'CVE-2026-77150 XSS attempt on show_preview'"
    SecRule ARGS:action "@streq show_preview" \
        "chain"
        SecRule ARGS:data[name] "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"