CVE-2026-13344: CWE-79 Cross-Site Scripting (XSS) in Essential Addons for Elementor
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
AI Analysis
Technical Summary
The Essential Addons for Elementor WordPress plugin versions prior to 6.6.10 contain a stored XSS vulnerability (CWE-79) in the Pricing Table widget title. The plugin fails to validate the HTML tag name of the title, enabling users with Contributor-level or higher privileges to inject malicious JavaScript. This script executes in the context of users viewing the affected page, including administrators previewing or visiting the post, potentially leading to session compromise or other malicious actions.
Potential Impact
Users with Contributor-level access or higher can inject persistent JavaScript code into the Pricing Table widget title. This code executes in the browsers of users who view the affected page, including administrators, potentially allowing attackers to hijack sessions, perform actions on behalf of administrators, or steal sensitive information. The vulnerability affects the integrity and confidentiality of the affected WordPress site.
Mitigation Recommendations
No official patch or remediation has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only, and monitor for suspicious activity related to the Pricing Table widget titles.
CVE-2026-13344: CWE-79 Cross-Site Scripting (XSS) in Essential Addons for Elementor
Description
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
CVSS v3.1
Score 4.8medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Essential Addons for Elementor WordPress plugin versions prior to 6.6.10 contain a stored XSS vulnerability (CWE-79) in the Pricing Table widget title. The plugin fails to validate the HTML tag name of the title, enabling users with Contributor-level or higher privileges to inject malicious JavaScript. This script executes in the context of users viewing the affected page, including administrators previewing or visiting the post, potentially leading to session compromise or other malicious actions.
Potential Impact
Users with Contributor-level access or higher can inject persistent JavaScript code into the Pricing Table widget title. This code executes in the browsers of users who view the affected page, including administrators, potentially allowing attackers to hijack sessions, perform actions on behalf of administrators, or steal sensitive information. The vulnerability affects the integrity and confidentiality of the affected WordPress site.
Mitigation Recommendations
No official patch or remediation has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only, and monitor for suspicious activity related to the Pricing Table widget titles.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-25T14:13:28.095Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6aee089c2644c7f8a7ef25
Added to database: 07/30/2026, 06:24:08 UTC
Last enriched: 07/30/2026, 07:08:17 UTC
Last updated: 07/30/2026, 22:57:28 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.