Is CVE-2026-102394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102394 being exploited in the wild.

How severe is CVE-2026-102394?

Medium severity, with a CVSS score of 6.5, published 1 October 2026.

Which products and versions are affected?

WPDeveloper Essential Addons for Elementor through 6.8.4.

Is there a fix for CVE-2026-102394?

Yes: fixed in 6.8.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102394 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102394?

Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102394: WPDeveloper Essential Addons for Elementor stored cross-site scripting

CVE-2026-102394 · Severity: medium · CVSS 6.5 · Published 2026-10-01

Essential Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional components and functionality. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows contributors or higher-privilege users to inject malicious scripts into pages. When other users visit affected pages, their browsers execute these scripts, potentially stealing data or hijacking their accounts.

Technologies: WPDeveloper Essential Addons for Elementor. Vendors: WPDeveloper.

Quick answers

Is CVE-2026-102394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102394 being exploited in the wild.
How severe is CVE-2026-102394?: Medium severity, with a CVSS score of 6.5, published 1 October 2026.
Which products and versions are affected?: WPDeveloper Essential Addons for Elementor through 6.8.4.
Is there a fix for CVE-2026-102394?: Yes: fixed in 6.8.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102394 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102394?: Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.8.5

Technical details

A stored XSS flaw in Essential Addons for Elementor through version 6.8.4 stems from improper neutralization of user input during web page generation. The vulnerability requires a user with contributor privileges or above to inject malicious script payloads, which are then persisted and executed in the browsers of all visitors. This is a medium-severity issue with a CVSS 6.5 score; exploitation requires user interaction in the form of a privileged account performing a malicious action.

Affected products

WPDeveloper Essential Addons for Elementor through 6.8.4

Timeline

2026-10-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.