CVE-2026-85575
6.4 · Medium
Stored XSS in ShopEngine through the product title heading tag
Our Author-role PoC confirmed stored XSS in ShopEngine 4.8.9, from Elementor storage to execution in a visitor’s browser.
Domain
WordPress
WordPress plugins and Elementor widgets.
2 write-ups, 7 vulnerabilities
CVE-2026-6504 +5
6.4 · Medium
Six stored XSS in WordPress plugins: when a tag name becomes an attack vector
Variant analysis of six WordPress plugins that printed an HTML tag name chosen by a Contributor without an allow-list, each leading to stored XSS.
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-85575 | ShopEngine (Elementor WooCommerce Builder) | Stored XSS through the product title heading tag | 6.4 Medium | |
| CVE-2026-18988 | Easy Accordion | Stored XSS through accordionTitleTag in Easy Accordion | 6.4 Medium | |
| CVE-2026-11390 | News Kit Addons for Elementor | Stored XSS through the Site Logo Title and Single Author Box tags in News Kit Addons | 6.4 Medium | |
| CVE-2026-8607 | myCred | Stored XSS through the wrap shortcode attribute in myCred | 6.4 Medium | |
| CVE-2026-8613 | aThemes Addons for Elementor | Stored XSS through title_tag in aThemes Addons | 6.4 Medium | |
| CVE-2026-8677 | Prime Elementor Addons | Stored XSS through widget HTML tag settings in Prime Elementor Addons | 6.4 Medium | |
| CVE-2026-6504 | Royal Addons for Elementor | Stored XSS through title_tag in Royal Addons | 6.4 Medium |
