CVE-2026-110510: fallo de gravedad baja en Essential Addons for Elementor
Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 3.5epss 0.1%
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Productos afectados
Unknown · Essential Addons for ElementorPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/ae0793fa-0223-40d9-836e-f9c6a0fbf80f/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Essential Addons for Elementor
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-0320—Essential Addons for Elementor < 5.0.5 - Unauthenticated LFIEPSS 2.0%CVE-2021-24255—Essential Addons for Elementor < 4.5.4 - Contributor+ Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2026-18039HIGHEssential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass AssignmentEPSS 0.4%CVE-2026-13345MEDIUMEssential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare TableEPSS 0.3%CVE-2026-110508MEDIUMEssential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP VerificationEPSS 0.3%CVE-2026-110509MEDIUMEssential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX HandlerEPSS 0.3%