CVE-2026-1512 is a stored cross-site scripting vulnerability (CWE-79) in the Essential Addons for Elementor – Popular Elementor Templates & Widgets WordPress plugin. The flaw exists in the Info Box widget due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes. This allows authenticated users with contributor-level privileges or higher to inject malicious scripts that execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to 6.5.9. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. No patch or vendor advisory is currently available.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure or session hijacking but does not impact availability. The vulnerability is limited to authenticated users with certain privileges and does not require user interaction to trigger once the malicious content is injected. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Info Box widget in the plugin. Monitor for updates from the vendor (wpdevteam) and apply any official patches promptly once available.