CVE-2026-15787: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in brainstormforce Ultimate Addons for Elementor
The Ultimate Addons for Elementor WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its Navigation Menu Widget data-toggle-icon and data-close-icon attributes. This affects all versions up to and including 2.9.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because input sanitization and output escaping are insufficient, allowing HTML-entity-encoded payloads to bypass wp_kses_post filtering and be rendered as executable markup by the browser.
AI Analysis
Technical Summary
CVE-2026-15787 is a stored cross-site scripting vulnerability in the Ultimate Addons for Elementor WordPress plugin, specifically in the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes. The plugin fails to properly sanitize and escape input, allowing authenticated users with contributor-level privileges or higher to inject arbitrary scripts. The issue stems from wp_kses_post not neutralizing HTML-entity-encoded payloads stored inside data-* attributes, which browsers decode client-side before jQuery renders them as markup. This vulnerability affects all versions up to and including 2.9.1.
Potential Impact
An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the Navigation Menu Widget attributes. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes. Monitor official Brainstormforce communications for updates and apply any official patches once released.
CVE-2026-15787: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in brainstormforce Ultimate Addons for Elementor
Description
The Ultimate Addons for Elementor WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its Navigation Menu Widget data-toggle-icon and data-close-icon attributes. This affects all versions up to and including 2.9.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because input sanitization and output escaping are insufficient, allowing HTML-entity-encoded payloads to bypass wp_kses_post filtering and be rendered as executable markup by the browser.
CVSS v3.1
Score 6.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15787 is a stored cross-site scripting vulnerability in the Ultimate Addons for Elementor WordPress plugin, specifically in the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes. The plugin fails to properly sanitize and escape input, allowing authenticated users with contributor-level privileges or higher to inject arbitrary scripts. The issue stems from wp_kses_post not neutralizing HTML-entity-encoded payloads stored inside data-* attributes, which browsers decode client-side before jQuery renders them as markup. This vulnerability affects all versions up to and including 2.9.1.
Potential Impact
An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the Navigation Menu Widget attributes. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes. Monitor official Brainstormforce communications for updates and apply any official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-14T19:24:21.378Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a608beb9c2644c7f8c1b982
Added to database: 07/22/2026, 09:22:51 UTC
Last enriched: 07/22/2026, 09:38:01 UTC
Last updated: 07/22/2026, 09:58:54 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.