CVE-2026-9243: Elementor Plus Addons XSS Vulnerability

CVE-2026-9243 Overview

CVE-2026-9243 is a stored Cross-Site Scripting (XSS) vulnerability in The Plus Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 6.4.15 and resides in the Carousel Anything widget. The carousel_direction parameter is rendered into an unquoted HTML dir= attribute by the widget's render() function. Although esc_attr() is applied, the missing quotes around the attribute permit attribute injection that bypasses the escaping. Authenticated users with contributor-level access or higher can store malicious payloads that execute in any visitor's browser when an injected page is loaded.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against every visitor, enabling session theft, admin account takeover, and arbitrary actions in the context of higher-privileged users.

Affected Products

The Plus Addons for Elementor (WordPress plugin) versions up to and including 6.4.15
Fixed in version 6.4.16
Component: tp_carousel_anything.php (Carousel Anything widget)

Discovery Timeline

2026-05-29 - CVE-2026-9243 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-9243

Vulnerability Analysis

The vulnerability is a stored XSS issue classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). It exists in the Carousel Anything widget shipped with The Plus Addons for Elementor. Contributors and higher-privileged roles can save widget configurations that include a crafted carousel_direction value. When the page containing the widget is rendered, the malicious payload is emitted into the HTML output and executes in every viewer's browser context. Because the payload persists in post content, exploitation does not require any further interaction from the attacker after the initial save.

Root Cause

The render() function in tp_carousel_anything.php writes the carousel_direction value into an HTML dir= attribute without surrounding quotes. The plugin relies on esc_attr() for sanitization, but esc_attr() is only safe when the attribute value is properly quoted. Without quotes, an attacker can break out of the attribute context using a whitespace character followed by additional attributes such as onmouseover or onfocus, achieving script execution without needing characters that esc_attr() would encode.

Attack Vector

An authenticated attacker with at least contributor-level access creates or edits a page using the Carousel Anything widget. The attacker supplies a payload for the carousel_direction setting that injects an event handler into the unquoted dir attribute. Once the post is published or previewed by a higher-privileged user, the injected JavaScript runs in that user's session. This can be leveraged to escalate privileges, hijack administrator sessions, or modify site content. Refer to the Wordfence Vulnerability Report and the WordPress Code Review for the vulnerable code path.

No verified proof-of-concept code is available. The vulnerability mechanism is described in prose only; see the WordPress Change Log for the upstream fix.

Detection Methods for CVE-2026-9243

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs inside post content stored in wp_posts for pages using Elementor and The Plus Addons.
Elementor widget metadata containing non-standard values for the carousel_direction setting (legitimate values are limited to ltr and rtl).
New or modified administrator accounts following contributor activity on pages that embed the Carousel Anything widget.

Detection Strategies

Audit the _elementor_data post meta entries for tp-carousel-anything widget instances and flag any carousel_direction value that does not match the expected enumerated tokens.
Review web server access logs for POST requests to admin-ajax.php and Elementor save endpoints originating from contributor accounts that touch pages containing the affected widget.
Run authenticated dynamic scans against staging copies of the site to identify reflected script execution in pages built with the Carousel Anything widget.

Monitoring Recommendations

Alert on creation or modification of WordPress user accounts performed from sessions that previously accessed pages containing Carousel Anything widgets.
Monitor browser-side errors and Content Security Policy (CSP) violation reports for inline script execution on pages built with Elementor.
Track plugin version inventory across WordPress sites and flag instances of The Plus Addons for Elementor at version 6.4.15 or earlier.

How to Mitigate CVE-2026-9243

Immediate Actions Required

Update The Plus Addons for Elementor to version 6.4.16 or later on every WordPress site that uses the plugin.
Review all pages that include the Carousel Anything widget and reset any non-standard carousel_direction values to ltr or rtl.
Audit recent contributor and author activity for suspicious post edits and revoke unused contributor accounts.

Patch Information

The vendor addressed the issue in The Plus Addons for Elementor version 6.4.16. The fix is documented in the WordPress Change Log and quotes the previously unquoted attribute output in tp_carousel_anything.php so that esc_attr() provides effective sanitization.

Workarounds

If immediate patching is not possible, disable or remove The Plus Addons for Elementor plugin until the upgrade is applied.
Restrict contributor and author role assignments to trusted users only, since exploitation requires authenticated access.
Deploy a Content Security Policy (CSP) that disallows inline scripts and event handlers to reduce the impact of stored XSS payloads.
Place a Web Application Firewall (WAF) rule in front of WordPress admin endpoints to block payloads containing event handler attributes in widget save requests.

bash

# Configuration example: upgrade the plugin via WP-CLI
wp plugin update the-plus-addons-for-elementor-page-builder --version=6.4.16
wp plugin get the-plus-addons-for-elementor-page-builder --field=version