CVE Database /
CVE-2026-15285
CVE · Medium
CVE-2026-15285 — The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder] < 6.4.12
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-15285
|
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder] < 6.4.12 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 6.4.12
|
6.4.12 |
2026-05-21 |
—
|
CVE-2026-15285
A stored cross-site scripting vulnerability was present in the Plus Addons for Elementor plugin for WordPress, specifically affecting versions up to and including 6.4.11. In these affected versions, contributor-level users could inject malicious JavaScript code via the Button widget's custom attributes setting, which was not properly sanitized due to a bypassable filter. This issue has been resolved in version 6.4.12 of the plugin.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings