CVE-2026-66574 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting Element Pack Elementor Addons versions up to 8.8.3. It allows a contributor-level user to perform cross-site scripting (XSS) attacks by injecting malicious scripts into web pages generated by the plugin. The vulnerability is network exploitable with low attack complexity, requires low privileges, and user interaction is needed. The impact includes partial confidentiality, integrity, and availability loss.

An attacker with contributor-level privileges can exploit this vulnerability to execute arbitrary scripts in the context of the affected web application. This can lead to partial disclosure of sensitive information, modification of content, and disruption of availability. The vulnerability affects the confidentiality, integrity, and availability of the affected system to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict contributor privileges and monitor for suspicious activity related to script injection.