CVE-2026-110510lowCWE-345

CVE-2026-110510: low-severity vulnerability in Essential Addons for Elementor

Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

Published

Follow this CVE+ Monitor Essential Addons for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 3.5epss 0.1%
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected products
Unknown · Essential Addons for Elementor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Essential Addons for Elementor

In the same product, most dangerous first.

CVE-2022-0320—Essential Addons for Elementor < 5.0.5 - Unauthenticated LFIEPSS 2.0%CVE-2021-24255—Essential Addons for Elementor < 4.5.4 - Contributor+ Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2026-18039HIGHEssential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass AssignmentEPSS 0.4%CVE-2026-13345MEDIUMEssential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare TableEPSS 0.3%CVE-2026-110508MEDIUMEssential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP VerificationEPSS 0.3%CVE-2026-110509MEDIUMEssential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX HandlerEPSS 0.3%