CVE-2026-126029

Name of the Vulnerable Software and Affected Versions WPZOOM Addons for Elementor – Starter Templates & Widgets versions prior to 1.4.21

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the actions[save builder][data][elements][...][settings][regions][i][link][url] and actions[save builder][data][elements][...][settings][pins][i][link][url] parameters. These scripts execute whenever a user accesses the affected page.

Recommendations Update WPZOOM Addons for Elementor – Starter Templates & Widgets to version 1.4.21 or later.