CVE-2026-1512

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1512", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-27T22:58:33.198Z", "datePublished": "2026-02-14T09:49:39.256Z", "dateUpdated": "2026-04-08T17:26:18.987Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:18.987Z"}, "affected": [{"vendor": "wpdevteam", "product": "Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.5.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Info Box widget in all versions up to, and including, 6.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d652f383-ca3d-440e-a30f-64a50efd65e1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3456806/essential-addons-for-elementor-lite/tags/6.5.10/includes/Elements/Info_Box.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "knani alaaeddine"}], "timeline": [{"time": "2026-01-27T23:14:09.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-13T21:37:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:36:22.204741Z", "id": "CVE-2026-1512", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:44:02.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:36:22.204741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:22.890Z"}}], "cna": {"title": "Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget", "credits": [{"lang": "en", "type": "finder", "value": "knani alaaeddine"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpdevteam", "product": "Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.5.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-27T23:14:09.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-13T21:37:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d652f383-ca3d-440e-a30f-64a50efd65e1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3456806/essential-addons-for-elementor-lite/tags/6.5.10/includes/Elements/Info_Box.php"}], "descriptions": [{"lang": "en", "value": "The Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Info Box widget in all versions up to, and including, 6.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:18.987Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1512", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:18.987Z", "dateReserved": "2026-01-27T22:58:33.198Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T09:49:39.256Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets", "vendor": "wpdevteam", "versions": [{"lessThanOrEqual": "6.5.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Info Box widget in all versions up to, and including, 6.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Essential Addons para Elementor \u2013 Popular Elementor Templates &amp; Widgets para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del widget Info Box del plugin en todas las versiones hasta la 6.5.9, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida deficiente en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1512", "lastModified": "2026-06-17T10:15:58.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1512", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:36:22.204741Z", "version": "2.0.3"}}]}, "published": "2026-02-14T10:16:06.627", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3456806/essential-addons-for-elementor-lite/tags/6.5.10/includes/Elements/Info_Box.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d652f383-ca3d-440e-a30f-64a50efd65e1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.5.9]"}}], "product": "essential_addons_for_elementor_\u2013_popular_elementor_templates_&_widgets", "vendor": "wpdevteam"}], "analysis": {"en": {"generated_at": "2026-04-15T17:11:06.874421+00:00", "value": {"mitigation_remediation": ["Upgrade Essential Addons for Elementor to version 6.5.10 or later", "If an upgrade cannot be applied immediately, disable the Info Box widget for contributor roles to prevent the vulnerable code from executing", "Sanitize and escape all user supplied attributes in the Info Box widget to ensure proper output handling"], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting that allows authenticated contributors or higher to inject arbitrary JavaScript into pages"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets plugin, particularly versions up to and including 6.5.9. All installations of the plugin that have not upgraded to version 6.5.10 or later are potentially affected.", "description_and_impact": "The vulnerability exists in the Info Box widget of the Essential Addons for Elementor plugin for WordPress. Unsanitized user input and missing output escaping enable an authenticated user with contributor-level access to embed malicious scripts. These scripts run in the context of any user who visits a page that includes the compromised widget, exposing the site to cross\u2011site scripting attacks.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The low EPSS score of less than 1% suggests that exploitation is currently unlikely at scale, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only contributor\u2011level or higher authentication, which is a common capability on many WordPress sites. An attacker can inject arbitrary JavaScript that executes when a victim view the injected page, potentially leading to credential theft, session hijack, defacement, or other malicious actions."}}}}, "created": "2026-02-16T12:01:53.035282+00:00", "updated": "2026-04-15T17:30:10.463715+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpdevteam", "wpdevteam$PRODUCT$essential_addons_for_elementor_\u2013_popular_elementor_templates_&_widgets"]}