Security Bulletin — July 21, 2026: Two Stored XSS Flaws in Plugins With Millions of Installs — WPForms and Essential Addons for Elementor (CVE-2026-15782 & CVE-2026-15156)

This is our daily security overview, in which we review the published vulnerabilities and highlight those that are actually relevant for the operation of WordPress websites, online shops, and PHP applications. Every statement has been verified against the underlying primary source and linked at the end of the respective section. After the turbulent week around the “wp2shell” core-vulnerability chain, July 21 is noticeably quieter: the two entries freshly published today are not login-free catastrophes but two medium-severity stored cross-site scripting flaws. They still share one thing that makes them relevant — they sit in extensions that run on several million websites, and both can be triggered from a plain contributor account. That is precisely the recurring lesson: on a site with multiple authors, “contributor” is not a trusted role but an attack surface. A corrected release already exists for both.

Stored XSS in WPForms via the OptinMonster Integration (CVE-2026-15782)

The form builder WPForms — here in its AI Form Builder edition — is, with more than five million active installations, among the most widely used WordPress plugins in existence. In all releases up to and including version 2.0.0.1, the plugin fails to sanitize and escape a value from its OptinMonster integration before writing it into post content as the data-sitekey attribute. A logged-in user with contributor rights or above can thereby plant their own script markup, which is later executed in the browser of every visitor who opens the affected page. At CVSS 4.9 the severity is moderate, and the flaw is tied to a precondition: it only takes effect when the OptinMonster plugin is also active and a running inline campaign fires the corresponding load event. On sites where several people submit content, it nonetheless remains a real path for carrying script code into an administrator’s session context. The corrected version 2.0.0.2 closes the issue; anyone running an older release should update.

Sources: NVD — CVE-2026-15782 · WordPress.org — WPForms

Stored XSS in Essential Addons for Elementor via a Color Setting (CVE-2026-15156)

Essential Addons for Elementor is one of the most widespread widget collections for the Elementor page builder and runs on over two million websites. In all versions up to and including 6.6.11, the plugin fails to escape the value of the “Reading Progress” global color setting before it is output. Here too, an account with contributor rights or above is enough to inject script markup through this seemingly harmless configuration field, which is then executed in the visitor’s browser on every page view. The severity is CVSS 6.4 — slightly higher than in the WPForms case, because the flaw can cross the boundary between user and administrator context (the vector reports a scope change). What is notable is how inconspicuous the attack path is: a setting whose only job is to pick a color becomes the carrier for executable code. The developers fixed the issue in version 6.7.0.

Sources: NVD — CVE-2026-15156 · WordPress.org — Essential Addons for Elementor

Unsure whether you are affected? Get in touch.

---

This notice serves security-awareness purposes. The official advisories of the respective vendor and the primary sources linked above are always authoritative.