CVE-2026-13344: Essential Addons for Elementor Stored XSS in Pricing Table widget

CVE-2026-13344 · Severity: info · CVSS 6.8 · Published 2026-07-30

Essential Addons for Elementor is a popular WordPress plugin used to add advanced design elements to websites. A security flaw in the Pricing Table widget allows users with basic editing permissions (Contributor level) to inject malicious scripts into a page. If an administrator views or previews the affected page, these scripts could execute in their browser, potentially leading to unauthorized actions or site takeover.

Technologies: WPDeveloper Essential Addons for Elementor - Lite. Vendors: WPDeveloper.

Quick answers

Is CVE-2026-13344 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13344 being exploited in the wild.
How severe is CVE-2026-13344?
Informational severity, with a CVSS score of 6.8, published 30 July 2026.
Which products and versions are affected?
WPDeveloper Essential Addons for Elementor - Lite < 6.6.10.
Is there a fix for CVE-2026-13344?
A patch was published on 2026-07-13: Fixed in version 6.6.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13344 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-13344?
Check whether you run WPDeveloper Essential Addons for Elementor - Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Pricing Table widget of the Essential Addons for Elementor plugin due to insufficient validation of the 'eael_pricing_table_title_tag' parameter. While the title body is sanitized, the HTML tag name itself is output via esc_html() without adequate filtering of the tag name position. An attacker with Contributor-level privileges can bypass standard WordPress KSES filtering by injecting a payload into the tag name field (e.g., using an 'img' tag with an 'onerror' attribute). This script executes when the post is viewed or previewed by other users, including administrators. The issue is fixed in version 6.6.10.

Affected products

  • WPDeveloper Essential Addons for Elementor - Lite < 6.6.10

Timeline

  • 2026-07-13: disclosed: Publicly published by WPScan
  • 2026-07-13: patched: Fixed in version 6.6.10
  • 2026-07-30: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.