CVE-2026-15156 is a stored cross-site scripting vulnerability (CWE-79) in the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. The flaw exists in the Reading Progress Global Color Settings feature, where input is not properly sanitized or escaped before being stored and rendered. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability affects all plugin versions up to and including 6.6.11. No official patch or remediation information is provided in the available data.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, unauthorized actions, or theft of sensitive information. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Reading Progress Global Color Settings feature. Monitor vendor channels for updates and apply patches promptly once released.