CVE-2026-8677: Stored XSS in Prime Elementor Addons WordPress Plugin (v1.3.3)

Technical summary

CVE-2026-8677 is a Stored XSS vulnerability in Prime Elementor Addons affecting Widget HTML Tag Settings. The flaw stems from insufficient input sanitization and output escaping. Notably, the vulnerability exploits a bypass of Elementor's wp_kses_post() filter: payloads without HTML angle brackets (e.g., 'img src=x onerror=alert(document.domain)') pass through the filter unchanged at save time because wp_kses_post() does not strip event handlers in attribute contexts. This allows authenticated users with contributor-level or higher privileges to inject arbitrary JavaScript that persists in the database and executes in the browsers of all page visitors, regardless of their own unfiltered_html capability.

Business impact

Organizations relying on Prime Elementor Addons face a direct risk to their WordPress site integrity and user security. Compromised pages can redirect users, harvest credentials, deface content, or inject malicious downloads. The vulnerability is particularly dangerous because it affects authenticated users who are often trusted operationally—meaning a disgruntled contributor or a compromised contributor account becomes a vector for persistent site-wide attacks. Any multi-user WordPress environment using this plugin should treat this as a priority containment issue.

Affected systems

Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin through version 1.3.3 for WordPress. The plugin is installed and activated on WordPress sites that use Elementor page building. Any WordPress environment with the plugin active and users granted contributor-level or administrative access is in scope. Users with lower privileges (subscribers, authors without the unfiltered_html cap) cannot directly exploit this, but they may be targets of injected content.

Exploitability

Exploitability is moderate-to-high within environments where contributor-level access exists. An attacker needs WordPress authentication at contributor level or above, but does not need administrative privileges or the unfiltered_html capability. Once authenticated, the exploit is straightforward: inject a crafted payload (such as an img tag with an onerror event handler) into a widget's HTML setting, save the page, and the payload persists and executes for all site visitors. No user interaction beyond visiting the page is required. However, the attack is limited to those with initial widget editing access; it is not a zero-day or unauthenticated vector.

Remediation

Update Prime Elementor Addons to a version patched after 1.3.3 as soon as the vendor releases a fix. Until a patch is available, restrict contributor-level access strictly to trusted personnel, disable the plugin if it is non-critical, or manually audit all pages and widgets created or modified by contributors to remove suspicious HTML payloads. Implement capability restrictions so that only administrators can edit widget HTML settings if the plugin supports such controls.

Patch guidance

Monitor the Prime Elementor Addons plugin repository and vendor advisories for a patched version beyond 1.3.3. When available, apply the update immediately via the WordPress admin panel or command line. Verify the fix in release notes to confirm that input sanitization and output escaping for Widget HTML Tag Settings have been enhanced. Test the patched version in a staging environment first to ensure compatibility with existing page content.

Detection guidance

Search WordPress page and post post_content fields in the database for suspicious HTML or JavaScript patterns in Elementor widget data—specifically look for onerror, onclick, onload, and other event handlers embedded in img, script, iframe, or object tags. Review WordPress user audit logs for unexpected widget edits by contributor or author accounts, especially after hours or from unfamiliar locations. Monitor browser console errors and network logs for unexpected script execution on pages using Prime Elementor Addons widgets. Use a WordPress security plugin with XSS detection capabilities to scan widget configurations.

Why prioritize this

Although the CVSS score is 6.4 (MEDIUM), the practical risk is elevated because this is a Stored XSS affecting all site visitors and requires only user-level authentication to exploit. The persistent nature of stored XSS makes it especially dangerous—the payload remains live until manually removed. For multi-user or public-facing WordPress sites, this should be treated as a high-priority containment and remediation issue, especially if contributor accounts are in use.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects Medium severity because the attack vector is network (reachable remotely), requires low complexity, requires authenticated access (contributor-level), involves no user interaction at exploit time, and impacts confidentiality and integrity across scope (other users' sessions). However, stored XSS poses greater real-world risk than reflected by the baseline score: persistence, broad impact across all visitors, and the common operational practice of granting contributor access to content teams all increase incident severity. Organizations should factor in their own risk tolerance for stored cross-site scripting when deciding priority.

Frequently asked questions