# CVE-2026-15285: POSIMYTH The Plus Addons for Elementor Stored XSS in Button widget

Source: https://junglewise.ai/threats/cve-2026-15285-posimyth-the-plus-addons-for-elementor-stored-xss-in-button  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-15285 · Severity: medium · CVSS 6.4 · Published 2026-07-10

The Plus Addons for Elementor, a popular WordPress plugin used to extend website design capabilities, contains a security flaw in its Button widget. This vulnerability allows users with contributor-level access or higher to inject malicious scripts into pages. If exploited, these scripts could execute in the browsers of other site visitors or administrators, potentially leading to unauthorized actions or data theft.

Technologies: [POSIMYTH Innovations The Plus Addons for Elementor](https://junglewise.ai/threats/technologies/the-plus-addons-for-elementor). Vendors: [POSIMYTH Innovations](https://junglewise.ai/threats/vendors/posimyth-innovations).

## Quick answers

**Is CVE-2026-15285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15285 being exploited in the wild.

**How severe is CVE-2026-15285?** Medium severity, with a CVSS score of 6.4, published 10 July 2026.

**Which products and versions are affected?** POSIMYTH Innovations The Plus Addons for Elementor up to and including 6.4.11.

**Is there a fix for CVE-2026-15285?** A patch was published on 2026-07-10: Patched in version 6.4.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15285 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15285?** Check whether you run POSIMYTH Innovations The Plus Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in The Plus Addons for Elementor plugin due to insufficient input sanitization in the Button widget. The 'render' function in 'modules/widgets/tp_button.php' processes the 'custom_attributes' setting through the 'tp_senitize_js_input()' filter, which can be bypassed. Authenticated attackers with Contributor-level permissions or higher can exploit this to inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page. The issue is resolved in version 6.4.12.

## Affected products

- POSIMYTH Innovations The Plus Addons for Elementor up to and including 6.4.11

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Patched in version 6.4.12

## References

- [https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.10/modules/helper-function.php](https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.10/modules/helper-function.php)
- [https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.10/modules/widgets/tp_button.php](https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.10/modules/widgets/tp_button.php)
- [https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.11/modules/widgets/tp_button.php](https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.11/modules/widgets/tp_button.php)
- [https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.12/modules/widgets/tp_button.php](https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.4.12/modules/widgets/tp_button.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3217f9-67e5-488d-b80a-49a61678fb98?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3217f9-67e5-488d-b80a-49a61678fb98?source=cve)

## Related threats

- [POSIMYTH The Plus Addons for Elementor Stored XSS in Carousel Anything](https://junglewise.ai/threats/cve-2026-9243-posimyth-the-plus-addons-for-elementor-stored-xss-in-carousel)
- [POSIMYTH The Plus Addons for Elementor stored XSS in Navigation Menu Lite](https://junglewise.ai/threats/cve-2026-5243-posimyth-the-plus-addons-for-elementor-stored-xss-in-navigation)
- [POSIMYTH The Plus Addons for Elementor Stored XSS in Progress Bar](https://junglewise.ai/threats/cve-2026-3311-posimyth-the-plus-addons-for-elementor-stored-xss-in-progress-bar)