CVE-2026-15787

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 2.9.2

Description Insufficient input sanitization and output escaping in the Navigation Menu Widget allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts through the data-toggle-icon and data-close-icon attributes. This occurs because the wp kses post function fails to neutralize HTML-entity-encoded payloads within data-* attributes on allowed elements, which the browser then decodes client-side before jQuery .html() renders them as markup.

Recommendations Update to a version newer than 2.9.1.