CVE-2026-13344
Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jul 30, 2026
- Updated
- Jul 30, 2026
- Reserved
- Jun 25, 2026
Description
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Essential Addons for ElementorUnknown |
|
References
- https://wpscan.com/vulnerability/d212286d-e152-4bfa-a9e4-a4940ec4adf9/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.