CVE-2026-110510: Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

Q: Which sites are exposed to this issue?

Sites using WPDeveloper Essential Addons for Elementor versions earlier than 6.8.7 are affected if users with the WordPress author role or higher can create or edit content using the affected widgets.

Q: What access does an attacker need?

An attacker needs an authenticated WordPress account with author-level privileges or higher. The issue is not described as exploitable by unauthenticated visitors.

Q: What can a successful exploit do?

A qualifying user can inject iframe and form elements into published pages through the affected widget title-tag setting. The affected widgets are Pricing Table and Post Timeline.

Q: How can I mitigate the issue if I cannot update immediately?

Restrict author-level and higher access to trusted users, and prevent untrusted users from editing content with the Pricing Table or Post Timeline widgets. Review published pages created or edited by such users for injected iframe or form elements.

Published Oct 23, 2026

Updated

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

Affected Software

1 affected component

WPDeveloper Essential Addons for Elementor<6.8.7

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using WPDeveloper Essential Addons for Elementor versions earlier than 6.8.7 are affected if users with the WordPress author role or higher can create or edit content using the affected widgets.

What access does an attacker need?

An attacker needs an authenticated WordPress account with author-level privileges or higher. The issue is not described as exploitable by unauthenticated visitors.

What can a successful exploit do?

A qualifying user can inject iframe and form elements into published pages through the affected widget title-tag setting. The affected widgets are Pricing Table and Post Timeline.

How can I mitigate the issue if I cannot update immediately?

Restrict author-level and higher access to trusted users, and prevent untrusted users from editing content with the Pricing Table or Post Timeline widgets. Review published pages created or edited by such users for injected iframe or form elements.

CVE-2026-110510: Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

Affected Software

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What access does an attacker need?

What can a successful exploit do?

How can I mitigate the issue if I cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What access does an attacker need?

What can a successful exploit do?

How can I mitigate the issue if I cannot update immediately?