Junglewise Threat Intelligence

CVE-2026-8677: BoomDevs Prime Elementor Addons Stored XSS in Widget HTML Tag Settings

CVE-2026-8677 · Severity: medium · CVSS 6.4 · Published 2026-06-09

Executive brief

The Prime Elementor Addons plugin for WordPress, which provides additional design widgets for the Elementor page builder, is vulnerable to a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users, including administrators, visit the affected pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technical details

The Prime Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via Widget HTML Tag Settings in versions up to and including 1.3.3. The vulnerability stems from insufficient input sanitization and output escaping on user-provided HTML tag attributes. Authenticated attackers with contributor-level permissions or higher can inject malicious JavaScript payloads. Because the exploit can be crafted without HTML angle brackets (e.g., using event handlers like 'onerror'), it bypasses standard WordPress filters like wp_kses_post(). When a victim views the compromised page, the script executes in their browser context. A fix was introduced in version 1.3.4.

Affected products

  • BoomDevs Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages <= 1.3.3

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory

References