CVE-2026-15285: Plus Addons for Elementor Stored XSS Vulnerability (Button Widget)

Technical summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in Plus Addons for Elementor versions up to 6.4.11. The Button widget's `custom_attributes` parameter is processed by the `render()` function in `modules/widgets/tp_button.php` and passed through a sanitization function called `tp_senitize_js_input()`. This filter is bypassable, allowing authenticated users with Contributor role or above to inject arbitrary JavaScript. The injected payload persists in the database and executes whenever the page is rendered, affecting all users who access it.

Business impact

Organizations using Plus Addons for Elementor are exposed to defacement, malware distribution, credential theft, and unauthorized actions taken on behalf of website administrators. Because the vulnerability requires authentication, the risk is primarily from insider threats or compromised contributor accounts. If an attacker gains access to a low-privilege WordPress account, they can inject malicious scripts that compromise higher-privilege users and site visitors. For sites with public user registration or guest contributors, the attack surface is broader.

Affected systems

The Plus Addons for Elementor plugin for WordPress in versions up to and including 6.4.11 is affected. The vulnerability is specific to the Button widget and its `custom_attributes` setting. Any WordPress site running a vulnerable version of this plugin with the Button widget in use is at risk if any Contributor-level or higher account is compromised or if insider threats exist.

Exploitability

Exploitation requires authentication (Contributor role or above) and does not require user interaction to trigger in the browser—the injected script fires automatically when the page loads. While not trivially exploitable by unauthenticated attackers, the threshold is relatively low since many WordPress sites grant Contributor access to multiple users, and account compromise is a common attack vector. The bypass of the `tp_senitize_js_input()` function suggests the sanitization logic has logical flaws rather than relying on an inherently weak approach.

Remediation

Update Plus Addons for Elementor to version 6.4.12 or later immediately. This patch addresses the sanitization bypass in the Button widget's custom_attributes handling. After patching, audit any Button widgets created by contributors during the window the plugin was vulnerable to ensure no malicious payloads remain in the database.

Patch guidance

Navigate to your WordPress plugin dashboard and update Plus Addons for Elementor to version 6.4.12 or the latest available version. Verify the update completed successfully and the plugin remains active. If auto-updates are disabled, perform the update manually or via your hosting provider's plugin management interface. Test functionality on a staging environment first if the plugin is critical to your site layout or functionality.

Detection guidance

Search the WordPress posts, pages, and custom post types table for Button widgets containing suspicious JavaScript in the `custom_attributes` field—look for `onclick`, `onerror`, `onload`, or script tags embedded in attribute values. Review WordPress user activity logs for any edits to pages containing Button widgets by Contributor-level accounts, particularly around the plugin installation date or after suspected compromise. Monitor for unexpected JavaScript execution errors in browser consoles on affected pages.

Why prioritize this

This vulnerability is rated MEDIUM (CVSS 6.4) and should be addressed within your standard patch cycle, typically 1–2 weeks. It is not on the CISA Known Exploited Vulnerabilities (KEV) list, indicating no active exploitation in the wild has been reported. However, the low barrier to exploitation (Contributor access) means organizations with high contributor-account churn, guest posting, or less-restrictive user permissions should prioritize it higher. Sites relying on this plugin for critical page layouts should patch promptly to avoid potential defacement or visitor compromise.

Risk score, explained

The CVSS 6.4 MEDIUM score reflects the requirement for authenticated access (PR:L), the ability to affect multiple users across the network (S:C), and the limited impact scope (confidentiality and integrity compromised, no availability impact). The score does not account for ease of account compromise or the prevalence of the plugin in WordPress installations; those contextual factors should inform your internal risk prioritization.

Frequently asked questions