CVE-2026-85575 Overview
CVE-2026-85575 is a Stored Cross-Site Scripting (XSS) vulnerability in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress. The flaw exists in all versions up to and including 4.9.5. It stems from insufficient input sanitization and output escaping on the shopengine_product_title_header_size parameter. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts. These scripts execute in the browser of any user who accesses an affected page. The vulnerability is tracked under [CWE-79] and affects sites that expose content authoring roles to lower-trust users.
Critical Impact
Authenticated Author-level users can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, redirects, and admin account takeover.
Affected Products
- ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress
- All versions up to and including 4.9.5
- WordPress sites permitting Author-level or higher user registration
Discovery Timeline
- 2026-09-15 - CVE-2026-85575 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-85575
Vulnerability Analysis
The ShopEngine plugin extends Elementor with WooCommerce widgets, including product title header widgets. The shopengine_product_title_header_size parameter accepts user-supplied values that control heading markup. The plugin fails to sanitize the input on write and does not escape the value on output. Attacker-supplied payloads persist in the database and render into pages rendered by Elementor. Any visitor loading the affected page executes the injected script in their browser session. Because the payload is stored, exploitation is repeatable and can target authenticated administrators who preview or edit content.
Root Cause
The vulnerability originates from missing input validation and missing output escaping around the shopengine_product_title_header_size widget parameter. WordPress provides functions such as sanitize_text_field() and esc_attr() that the plugin does not apply to this attribute before it is written to persistent storage or rendered into HTML. This is a classic [CWE-79] Improper Neutralization of Input During Web Page Generation.
Attack Vector
An attacker requires an authenticated WordPress account with the Author role or higher. The attacker edits an Elementor page containing the affected widget and supplies a crafted value for the header size parameter. The malicious script is stored in the database. When any user loads the page, the browser parses the injected markup and executes attacker-controlled JavaScript. Because the scope is changed, the injected script can act on behalf of higher-privileged users viewing the page, including administrators.
No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-85575
Indicators of Compromise
- Unexpected <script> tags or JavaScript event handlers stored within Elementor page metadata containing shopengine_product_title_header_size.
- Outbound requests from site visitors to unfamiliar domains after loading ShopEngine-rendered pages.
- New WordPress administrator accounts or altered user roles created shortly after an Author-level user edits pages.
- Modifications to wp_postmeta entries containing ShopEngine widget data by non-administrator users.
Detection Strategies
- Audit ShopEngine widget attributes in the wp_postmeta table for values that contain HTML tags, javascript: URIs, or event handler attributes such as onerror or onload.
- Review WordPress audit logs for Author-level accounts editing pages containing ShopEngine widgets.
- Deploy a Web Application Firewall rule to identify script content in requests targeting the ShopEngine widget parameter.
Monitoring Recommendations
- Monitor browser Content Security Policy (CSP) violation reports for unexpected inline script execution on WooCommerce pages.
- Alert on privilege changes and administrator account creation events in WordPress.
- Track plugin update state and version drift across managed WordPress installations.
How to Mitigate CVE-2026-85575
Immediate Actions Required
- Update the ShopEngine plugin to a version later than 4.9.5 that includes the fix referenced in the WordPress Changeset Update.
- Audit all users assigned the Author role or higher and remove accounts that do not require content publishing rights.
- Inspect existing ShopEngine widget content for injected scripts and remove malicious payloads.
Patch Information
The vendor addressed the flaw in a plugin update published through the WordPress plugin repository. Review the WordPress Changeset Update for the specific code changes that add sanitization and escaping to the shopengine_product_title_header_size parameter.
Workarounds
- Restrict Author-level and higher WordPress accounts to trusted users only until the plugin is updated.
- Deploy a Web Application Firewall with rules that block script content submitted to Elementor widget parameters.
- Enforce a strict Content Security Policy that blocks inline script execution on pages rendered by ShopEngine widgets.
- Temporarily disable the ShopEngine plugin on sites that cannot immediately apply the update.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
