CVE-2026-81777

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to and including 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar.

The Essential Addons for Elementor plugin for WordPress up to version 6.6.4 has an information exposure vulnerability via the ajax_load_more function. Unauthenticated attackers can extract data from password-protected, private, or draft posts.

The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature. This allows unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it. This allows users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Essential Addons for Elementor plugin for WordPress is vulnerable to administrator account takeover via email header injection. This affects all versions up to and including 6.6.10 due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers. An authenticated attacker with Contributor-level access or higher can inject a Bcc header to receive a copy of the administrator's password reset link and achieve full account takeover.

Unauthenticated Broken Access Control exists in Essential Addons for Elementor versions below 6.6.0.