CVE-2026-15156
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
The risk includes the injection of malicious scripts that can steal user data, hijack sessions, or perform other attacks on site visitors.
Recommendation
It is recommended to immediately update the Essential Addons for Elementor plugin to a version above 6.6.11 and implement appropriate Content Security Policies (CSP).
Other vulnerabilities in Essential Addons for Elementor
See all- CVE-2026-6459Medium
The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to and including 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar.
- CVE-2026-7665Medium
The Essential Addons for Elementor plugin for WordPress up to version 6.6.4 has an information exposure vulnerability via the ajax_load_more function. Unauthenticated attackers can extract data from password-protected, private, or draft posts.
- CVE-2026-81777Medium
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor from n/a through 6.8.0.
- CVE-2026-13345Medium
The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature. This allows unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
- CVE-2026-13344Medium
The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it. This allows users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
- CVE-2026-15145Medium
The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-15155High
The Essential Addons for Elementor plugin for WordPress is vulnerable to administrator account takeover via email header injection. This affects all versions up to and including 6.6.10 due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers. An authenticated attacker with Contributor-level access or higher can inject a Bcc header to receive a copy of the administrator's password reset link and achieve full account takeover.
- CVE-2026-25440Medium
Unauthenticated Broken Access Control exists in Essential Addons for Elementor versions below 6.6.0.
Original NVD description (English source)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.