Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

WordPress Plugin Allows Attackers to Inject Malicious Code

CVE-2026-1397
Summary

A security issue in the PQ Addons – Creative Elementor Widgets plugin for WordPress allows authenticated attackers to inject malicious code into web pages, which can be executed when a user visits the page. This affects all versions of the plugin up to 1.0.0. To fix the issue, update the plugin to the latest version or remove it if you don't need it.

Original title
The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient in...
Original description
The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on the html_tag parameter in the PQ Section Title widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
nvd CVSS3.1 6.4
Vulnerability type
CWE-79 Cross-site Scripting (XSS)
Published: 21 Mar 2026 · Updated: 21 Mar 2026 · First seen: 21 Mar 2026