What is the CVSS score of CVE-2026-102394?

CVE-2026-102394 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Essential Addons CVE-2026-102394

EUVD-2026-90805 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-10-01 Patchstack

GHSA-pg7j-jmf5-3c84

WordPress XSS Essential Addons For Elementor Wordpress Plugin Wpdeveloper

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Authenticated contributor-level injection (PR:L) with victim view required (UI:R) and scope change to the browser context (S:C); low C/I from script execution, no genuine availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 01, 2026 - 13:25 vuln.today

CVE Published

Oct 01, 2026 - 12:35 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

AnalysisAI

Stored cross-site scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.8.4) allows an authenticated user holding at least contributor- or editor-level privileges to persist malicious JavaScript through plugin widget content, which then executes in the browser of any visitor or administrator who views the affected page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 6.5, per Patchstack). Because the injected script runs in the context of the victim's session and the vulnerability scope changes (S:C), an attacker can potentially act with the victim's privileges against the site, though exploitation requires both a valid low-privilege account and a victim who subsequently loads the poisoned content. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated WordPress account with at least contributor/editor-level access capable of adding or editing Essential Addons for Elementor widget content (PR:L), plus a victim who subsequently views the page or screen where the stored payload renders (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-priority stored XSS in a very widely deployed WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The provided data does not identify a specific patched release version, so the first action is to confirm the current fix level with WPDeveloper and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve) and upgrade the plugin to the first version released after 6.8.4 as soon as it is published, testing on staging first because Elementor add-on updates can alter widget rendering. … Detailed patch versions, workarounds, and compensating controls in full report.