Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Essential Addons for Elementor - Security Vulnerability (CVE-2026-110808)
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that…
PLUGIN
Essential Addons for Elementor
CVE-2026-110808
Risk Score
Threat Entry
Updated 2026-10-30
Essential Addons for Elementor - Security Vulnerability (CVE-2026-118205)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing…
PLUGIN
Essential Addons for Elementor
CVE-2026-118205
Risk Score
Threat Entry
Updated 2026-10-23
Essential Addons for Elementor - Security Vulnerability (CVE-2026-110537)
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
PLUGIN
Essential Addons for Elementor
CVE-2026-110537
Risk Score
Threat Entry
Updated 2026-10-23
Essential Addons for Elementor - Security Vulnerability (CVE-2026-110510)
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.
PLUGIN
Essential Addons for Elementor
CVE-2026-110510
Risk Score
Threat Entry
Updated 2026-08-26
Essential Addons for Elementor - Security Vulnerability (CVE-2026-18039)
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
PLUGIN
Essential Addons for Elementor
CVE-2026-18039
Risk Score
Threat Entry
Updated 2026-07-30
Essential Addons for Elementor - Security Vulnerability (CVE-2026-13345)
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
PLUGIN
Essential Addons for Elementor
CVE-2026-13345
Risk Score
Threat Entry
Updated 2026-07-30
Essential Addons for Elementor - Cross-Site Scripting (XSS) (CVE-2026-13344)
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
PLUGIN
Essential Addons for Elementor
CVE-2026-13344
Risk Score
Threat Entry
Updated 2026-07-23
Essential Addons for Elementor - Cross-Site Scripting (XSS) (CVE-2026-15145)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons for Elementor
CVE-2026-15145
Risk Score
Threat Entry
Updated 2026-07-22
Essential Addons for Elementor - Cross-Site Scripting (XSS) (CVE-2026-15156)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons for Elementor
CVE-2026-15156
Risk Score
Threat Entry
Updated 2026-07-15
Essential Addons for Elementor - Security Vulnerability (CVE-2026-15155)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail…
PLUGIN
Essential Addons for Elementor
CVE-2026-15155
Risk Score
Threat Entry
Updated 2026-07-08
Essential Addons for Elementor - Cross-Site Scripting (XSS) (CVE-2026-6459)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons for Elementor
CVE-2026-6459
Risk Score
Threat Entry
Updated 2026-07-23
Essential Addons For Elementor - Information Disclosure (CVE-2026-7665)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
PLUGIN
Essential Addons For Elementor
CVE-2026-7665
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons for Elementor - Privilege Escalation (CVE-2026-5193)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register_user' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.
PLUGIN
Essential Addons for Elementor
CVE-2026-5193
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons for Elementor - Broken Access Control (CVE-2026-23543)
Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through
PLUGIN
Essential Addons for Elementor
CVE-2026-23543
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2026-1512)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Info Box widget in all versions up to, and including, 6.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons For Elementor
CVE-2026-1512
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons for Elementor - Information Disclosure (CVE-2026-1004)
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.
PLUGIN
Essential Addons for Elementor
CVE-2026-1004
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2025-69092)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through
PLUGIN
Essential Addons For Elementor
CVE-2025-69092
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons For Elementor - Cross-Site Scripting (XSS) (CVE-2025-13977)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons For Elementor
CVE-2025-13977
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons For Elementor - Broken Access Control (CVE-2025-64352)
Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through
PLUGIN
Essential Addons For Elementor
CVE-2025-64352
Risk Score
Threat Entry
Updated 2026-06-17
Essential Addons for Elementor - Cross-Site Scripting (XSS) (CVE-2025-8451)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons for Elementor
CVE-2025-8451
Risk Score