CVE-2026-9243

Description

The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED Reserved 2026-05-21 | Published 2026-05-29 | Updated 2026-05-29 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

João Pedro S Alcântara (Kinorth) finder

References

www.wordfence.com/...-1991-4100-9ef2-caea7743e45b?source=cve

plugins.trac.wordpress.org/...dgets/tp_carousel_anything.php

plugins.trac.wordpress.org/...dgets/tp_carousel_anything.php

plugins.trac.wordpress.org/...entor-page-builder/tags/6.4.16

cve.org (CVE-2026-9243)

nvd.nist.gov (CVE-2026-9243)

Download JSON