Executive brief
A popular WordPress plugin used to add custom templates and widgets to websites is vulnerable to a security flaw. This issue allows users with basic contributor-level access to inject malicious scripts into website pages. When other visitors or administrators view these pages, the scripts execute, potentially leading to unauthorized actions or data theft.
Technical details
The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the Reading Progress Global Color Settings. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts into a page. These scripts are stored on the server and execute in the context of any user's browser who visits the affected page. The vulnerability is present in all versions up to and including 6.6.11 and was addressed in version 6.7.0.
Affected products
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.6.11
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
References
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Classes/Bootstrap.php
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Core.php
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Elements.php
- https://plugins.trac.wordpress.org/changeset/3610135/essential-addons-for-elementor-lite/trunk/includes/Traits/Elements.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fessential-addons-for-elementor-lite/tags/6.6.11&new_path=%2Fessential-addons-for-elementor-lite/tags/6.7.0
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dde0cf3a-778b-4b5f-ac0e-600505d918ae?source=cve