CVE-2026-15285 is a stored cross-site scripting vulnerability in The Plus Addons for Elementor plugin for WordPress. Authenticated users with Contributor or higher privileges could exploit the Button widget's custom_attributes setting to inject malicious JavaScript. The root cause is that the render function in modules/widgets/tp_button.php passes the raw custom_attributes string through a sanitization function tp_senitize_js_input(), which is bypassable. This vulnerability affects versions up to and including 6.4.11 and was patched in version 6.4.12.

Successful exploitation allows an authenticated user with Contributor or higher privileges to execute arbitrary JavaScript in the context of the affected site. This can lead to theft of sensitive information, session hijacking, or other actions permitted by the victim's browser context. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges (low), no user interaction, and impact on confidentiality and integrity but not availability.

Upgrade The Plus Addons for Elementor plugin to version 6.4.12 or later, where this vulnerability is patched. No other mitigations are specified or required once the update is applied.