CVE-2026-15145

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions prior to 6.6.12

Description Insufficient input sanitization and output escaping in the Fancy Text Widget allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 6.6.11. As a temporary mitigation, restrict access to the Fancy Text Widget for users with contributor-level permissions.