CVE-2026-110898

The Essential Addons for Elementor plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 6.8.4. An attacker can inject malicious script that will execute in the browser of an administrator or other user.

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to and including 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar.

The Essential Addons for Elementor plugin for WordPress up to version 6.6.4 has an information exposure vulnerability via the ajax_load_more function. Unauthenticated attackers can extract data from password-protected, private, or draft posts.

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form. Authenticated users with Author-level access and above can cause newly registered accounts, including those created by unauthenticated visitors, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented, so versions 6.6.0 through 6.8.7 remain affected.

The Essential Addons for Elementor plugin for WordPress up to 6.8.7 is vulnerable to privilege escalation via the page_id parameter of the register_user() function. An unauthenticated attacker can register an account with a role as high as Editor by abusing revision status and nonce bypass. Exploitation requires user registration enabled and an administrator having previously saved and reverted a non-default role on an affected page.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint. This could allow reading content of non-public post types and recovering values of private custom fields on published posts.

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor from n/a through 6.8.0.

The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature. This allows unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it. This allows users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.