CVE-2026-9243: Stored XSS in Plus Addons for Elementor Carousel Widget

Technical summary

CVE-2026-9243 is a Stored Cross-Site Scripting (XSS) vulnerability in Plus Addons for Elementor versions ≤6.4.15. The Carousel Anything widget's render() function fails to properly escape the carousel_direction parameter before inserting it into an unquoted HTML dir= attribute. Although esc_attr() is called, the unquoted attribute context allows bypass through special characters, enabling attribute injection. An authenticated attacker with contributor or higher role can craft malicious input that persists in the WordPress database and executes whenever the page is viewed, affecting all site visitors.

Business impact

This vulnerability creates a persistent threat to website integrity and visitor security. An insider threat—or a compromised contributor account—can deface content, redirect users to malicious sites, steal authentication tokens, or deploy malware. For multi-author sites, editorial teams are exposed. The stored nature means the attack remains active until discovery and remediation, potentially affecting hundreds or thousands of page views. Customer trust and SEO reputation are at risk if exploited for phishing or malware distribution.

Affected systems

Plus Addons for Elementor plugin version 6.4.15 and all earlier versions are vulnerable. The vulnerability is triggered only when the Carousel Anything widget is used with the vulnerable carousel_direction parameter. Sites running later patched versions, or those not using this specific widget, are unaffected. The attack requires an authenticated WordPress user account with at least contributor-level capabilities.

Exploitability

Exploitability is moderate. An attacker must possess valid WordPress credentials at contributor level or above—a realistic scenario for sites with multiple editors, freelance contributors, or compromised accounts. No network access restrictions apply; exploitation occurs through normal WordPress UI or REST API. The attack requires no user interaction beyond the victim visiting the compromised page. However, the attacker cannot escalate privileges or execute code on the server itself; impact is limited to client-side browser context and session data.

Remediation

Update Plus Addons for Elementor to a patched version released after 6.4.15 (verify the exact version against the plugin's official changelog and security advisories). After patching, audit all pages containing the Carousel Anything widget to confirm no malicious carousel_direction values are stored. Review contributor account activity logs for suspicious carousel widget edits. Consider temporarily restricting Carousel Anything widget access to trusted authors pending patch deployment.

Patch guidance

Check the official Plus Addons for Elementor plugin repository or vendor security page for version 6.4.16 or later. Apply the update through the WordPress admin dashboard (Plugins → Updates) or manually via SFTP/file manager. Test on a staging environment first to ensure compatibility with your theme and other plugins. After deployment, flush any caching layers (page cache, CDN, object cache). Verify the widget functionality on pages using the Carousel Anything element. No database migration or manual code changes should be necessary; the patch should be transparent.

Detection guidance

Examine page and post revisions for Carousel Anything widget configurations, especially the carousel_direction parameter, for anomalous or suspicious values (e.g., containing quotes, angle brackets, or event handler syntax). Check WordPress user activity logs (via security plugins like Wordfence or audit logs) for contributor+ users editing pages with this widget around the published or modified dates of this CVE. Search database backups for stored payloads using grep patterns like dir=".*['";] or event handlers in widget serialized data. Monitor browser console errors on pages with Carousel Anything widgets for script injection warnings.

Why prioritize this

Although rated MEDIUM severity (CVSS 6.4), prioritize patching based on site role. High-priority: Multi-author sites, SaaS platforms with user-generated content, and public-facing WordPress installations. Moderate-priority: Single-author blogs or internal sites. The stored XSS nature, combined with contributor-level access prevalence in many organizations, elevates practical risk beyond the numerical score. Automated attack is unlikely but manual exploitation by insiders or account compromise is credible.

Risk score, explained

CVSS 3.1 score of 6.4 (MEDIUM) reflects: Attack Vector Network (easy remote access via WordPress), Attack Complexity Low (straightforward parameter injection), Privileges Required Low (contributor role common), User Interaction None (no victim action needed), Scope Changed (can affect other users), Confidentiality Low (session/data theft possible), Integrity Low (content modification), Availability None (no DoS). The score does not reflect organizational context; sites with relaxed contributor access or sensitive data may face elevated practical risk.

Frequently asked questions