CVE-2026-9243

Vulnerability

The Carousel Anything widget in the Plus Addons for Elementor plugin for WordPress, versions up to and including 6.4.15, contains a Stored Cross-Site Scripting vulnerability via the carousel_direction parameter. The render() function places the attacker-controlled value into an unquoted HTML attribute (dir=) despite using esc_attr(), allowing attribute injection. This flaw enables the injection of arbitrary web scripts [1][2].

Exploitation

An attacker must have at least contributor-level access to the WordPress site. By editing or creating a page or post containing the vulnerable Carousel Anything widget, the attacker can set the carousel_direction parameter to a malicious payload, such as ltr onmouseover=alert(1). The injected script will be stored in the database and executed when any user accesses the compromised page, due to the missing quote around the attribute value [1][2].

Impact

Successful exploitation allows authenticated attackers with contributor-level privileges to perform stored cross-site scripting attacks. When a victim visits the compromised page, the attacker's script executes in the context of the victim's session, potentially leading to session hijacking, credential theft, defacement, or further malicious actions. The impact is limited to users who interact with the injected page [1][2].

Mitigation

As of the publication date (2026-05-29), a fixed version has not been released. Users should monitor the plugin's official repository or vendor site for an update beyond version 6.4.15. As a workaround, site administrators can restrict contributor-level access to trusted users only or disable the Carousel Anything widget if not essential [1][2].