CVE-2026-102394: WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/essential-addons-for-elementor-liteto a version that resolves this vulnerability.Fixed in 6.8.5
Event History
Frequently Asked Questions
Which installations are affected?
Installations of WPDeveloper Essential Addons for Elementor are affected through version 6.8.4. The available data does not identify a fixed version.
What does an attacker need to exploit this issue?
The CVSS vector indicates network-reachable exploitation with low attack complexity, but the attacker must have low-level privileges and requires user interaction. The issue is stored XSS, so malicious input can be retained and later rendered in a web page.
What is the potential impact?
The vulnerability is rated medium severity with a CVSS score of 6.5. Its vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.