Description

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T09:16:34.583Z",
  "pubdate": "2026-09-19T09:16:34.583Z",
  "executiveSummary": "The Gum Addon for Elementor plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input validation and output sanitization protocols within the plugin's codebase.\nThe vulnerability allows authenticated attackers, possessing at least contributor-level privileges, to inject malicious client-side scripts—typically JavaScript—into the application's database via the 'pop_tag' parameter.\nOnce stored, these malicious scripts execute within the context of the victim's browser session whenever the compromised page is rendered. This exposure impacts all users viewing the injected content, including those with higher administrative privileges.\nThe risk implications are significant, as successful exploitation facilitates unauthorized actions performed on behalf of legitimate users, potential session hijacking, redirection to malicious domains, or the theft of sensitive session cookies.\nThe vulnerability persists in all versions of the Gum Addon for Elementor up to and including version 1.3.15.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Gum Addon for Elementor plugin to properly sanitize user-supplied input submitted through the 'pop_tag' parameter before storing it in the WordPress database, combined with a failure to perform adequate context-aware output encoding when rendering that data.\nThe vulnerability manifests because the plugin lacks rigorous input validation routines, such as those provided by WordPress core sanitization functions like sanitize_text_field() or esc_html(), which would otherwise neutralize executable script tags or malicious event handlers.\nThe attack flow proceeds as follows: First, an authenticated user with contributor-level privileges or higher accesses the administrative interface where the vulnerable 'pop_tag' parameter is processed. Second, the attacker submits a payload containing malicious JavaScript, such as '<script>alert(document.cookie)</script>' or event-based payloads like '<img src=x onerror=alert(1)>', into the 'pop_tag' field. Third, the plugin backend processes this input and commits it to the database without stripping the script tags or encoding the special characters.\nSubsequently, whenever an administrator or another user navigates to the front-end page or administrative post where the 'pop_tag' content is displayed, the plugin dynamically injects the stored, malicious payload into the HTML response stream. Because the browser interprets this injected content as legitimate, active code originating from the trusted domain, the script executes within the victim’s current session context.\nThe post-exploitation impact is severe, as the attacker can perform actions restricted to the victim’s privilege level, capture sensitive administrative session tokens, or perform unauthorized administrative modifications to the WordPress environment. Since the payload is stored persistently in the database, the exploit remains active until the malicious entry is manually removed from the database or the vulnerable code is patched.\nThis vulnerability is restricted to environments where the Gum Addon for Elementor plugin is active and is limited to authenticated users who have achieved the minimum required privilege of a contributor. No further network exposure is required beyond access to the specific settings or editing interfaces provided by the plugin."
}