Essential Addons CVE-2026-110510

Exploitation requires an authenticated WordPress account with the author role or higher on a site running Essential Addons for Elementor before 6.8.7, and the attacker must use one of the affected widgets and set a malicious value in its HTML tag setting, which the plugin fails to validate before building markup. Realistic risk is limited by three factors: the author-or-above privilege requirement (no anonymous access), the need for a victim to subsequently load the published page (UI:R), and the restricted impact - injection is confined to iframe and form elements, not arbitrary script execution. Default configurations of the vulnerable versions are affected once an author account exists.

This is a low-priority issue, not a high-CVSS-but-low-real-risk case - the signals are internally consistent and all point to low urgency. The CVSS base score is 3.5 (Low) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, meaning network-reachable but gated behind high privileges and requiring victim interaction, with only partial confidentiality/integrity impact and no availability impact. CISA's SSVC framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial, and the vuln.today decision label is 'monitor' (not act_now or emergency). There is no KEV listing and no EPSS score was provided in the input, so exploitation-probability data is missing rather than conflicting. One signal worth scrutiny: the vendor vector uses PR:H, but the description says the flaw is reachable by 'users with the author role and above' - an author is an authenticated low-privilege content role in WordPress, not an administrator, which argues for PR:L rather than PR:H; this would raise the score only marginally and does not change the overall low priority. The real impact is limited to injecting iframe and form elements (useful for phishing/clickjacking) rather than arbitrary script execution, consistent with the partial technical impact rating.

An attacker who already holds (or compromises) an author-level account on the target WordPress site edits a page using one of the affected Essential Addons for Elementor widgets and sets a malicious HTML tag value, causing an attacker-controlled iframe or form element to be baked into the published page. When a site visitor or administrator later loads that published page, the injected iframe or form renders - enabling phishing, credential-harvesting forms, or clickjacking against those viewers. No public exploit identified at time of analysis; only a WPScan advisory reference is available.