CVE-2026-8677 is a stored Cross-Site Scripting vulnerability in the Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages WordPress plugin. It affects all versions up to and including 1.3.3. The vulnerability is due to improper neutralization of input during web page generation, specifically in the Widget HTML Tag Settings. Authenticated attackers with contributor-level privileges or higher can inject malicious scripts that execute in the context of users visiting the compromised page. The attack payload bypasses the wp_kses_post() filter because it does not contain HTML angle brackets, allowing the script to be stored and executed without requiring unfiltered_html capability.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the Widget HTML Tag Settings. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting the use of the vulnerable widget settings. Monitor vendor channels for updates or patches addressing this vulnerability.