CVE-2026-66574
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Element Pack Elementor Addons plugin in versions up to and including 8.8.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
Risk Assessment
The script may execute in the browsers of other users, including administrators, enabling session theft or account takeover. This can lead to compromise of the WordPress site.
Recommendation
Update the Element Pack Elementor Addons plugin to a version newer than 8.8.3. Until then, limit the number of accounts with Contributor privileges.
Other vulnerabilities in Element Pack Elementor Addons
See all- CVE-2026-105873Medium
The Element Pack Elementor Addons plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.8.6.
- CVE-2026-105871Medium
The Element Pack Elementor Addons plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.8.6.
- CVE-2026-65502Medium
Bypass vulnerability in Element Pack Elementor Addons versions up to 8.7.13 allows an unauthenticated attacker to bypass security controls.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS