Ultimate Addons for Elementor <= 2.9.1 Stored XSS via Navigation Menu Widget (CVE-2026-15787)

Vulnerability Overview Vulnerability Name: Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes CVE ID: CVE-2026-15787 CVSS Score: 6.4 (Medium) Publish Date: July 21, 2026 Last Update Date: July 22, 2026 Researcher: Asaf Mozes Affected Scope Software Type: Plugin Software Name: Ultimate Addons for Elementor Affected Versions: <= 2.9.1 Fixed Version: 2.9.2 Remediation Fix Measure: Upgrade to version 2.9.2 or later fixed version Vulnerability Description A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Addons for Elementor plugin in versions 2.9.1 and earlier. Attackers can inject malicious scripts via the and attributes of the Navigation Menu widget. When a user visits a page containing these attributes, the script will be executed. References plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Recent Related Vulnerabilities Ultimate Addons for Elementor Lite <= 2.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload - CVE ID: CVE-2025-9703 - CVSS Score: 6.4 - Researcher: Tony - Date: September 15, 2025 Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update - CVE ID: CVE-2025-8488 - CVSS Score: 4.3 - Researcher: Peter Thaleikis - Date: August 1, 2025 Elementor Header & Footer Builder <= 1.46.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget - CVE ID: CVE-2024-11230 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: December 22, 2024 Elementor Header & Footer Builder <= 1.45.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload - CVE ID: CVE-2024-10325 - CVSS Score: 6.4 - Researcher: Francesco Carlucci - Date: November 7, 2024 Elementor Header & Footer Builder <= 1.43.43 - Authenticated (Contributor+) Information Disclosure via Shortcode - CVE ID: CVE-2024-10050 - CVSS Score: 4.3 - Researcher: Francesco Carlucci - Date: October 23, 2024 Elementor - Header, Footer & Blocks Template <= 1.35.35 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-33933 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: July 1, 2024 Elementor Header & Footer Builder <= 1.35.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget - CVE ID: CVE-2024-5757 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: June 12, 2024 Elementor Header & Footer Builder <= 1.26.26 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-2518 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: May 23, 2024 Elementor Header & Footer Builder <= 1.26.26 - Authenticated (Author+) HTML Injection - CVE ID: CVE-2024-2519 - CVSS Score: 5.0 - Researcher: wesley (wcraft) - Date: May 16, 2024 Elementor Header & Footer Builder <= 1.28.28 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-4634 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: May 15, 2024 Summary This vulnerability involves a stored cross-site scripting (XSS) issue in the Ultimate Addons for Elementor plugin, affecting versions <= 2.9.1. Users are advised to upgrade to version 2.9.2 or later as soon as possible to resolve this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Ultimate Addons for Elementor <= 2.9.1 Stored XSS via Navigation Menu Widget (CVE-2026-15787)