What is the CVSS score of CVE-2026-13344?

CVE-2026-13344 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-13344?

Yes, a public proof-of-concept exploit is available for CVE-2026-13344. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-13344?

Yes, a patch is available for CVE-2026-13344. Update the affected software to the latest version immediately.

Essential Addons for Elementor CVE-2026-13344

EUVD-2026-51011 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 WPScan

GHSA-wqx2-q6jg-7j96

WordPress XSS Essential Addons For Elementor

4.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L better reflects Contributor as a low-privilege role; all other metrics match the described stored XSS with scope change to admin session.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:34 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

4.8 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 4.8

DescriptionCVE.org

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

AnalysisAI

Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher user to inject arbitrary JavaScript via an unsanitized HTML tag name in the Pricing Table widget title field. The payload executes in the browser of any user who views the affected page - critically including administrators previewing or visiting the post - enabling session hijacking or privilege escalation to full site control. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain or compromise Contributor-level WordPress credentials

Delivery

Exploit

Inject JavaScript payload into widget title tag name field

Install

Publish or save page to persist the stored XSS

Wait for or socially engineer an administrator to preview the page

Execute

Payload executes in admin browser session

Impact

Exfiltrate session tokens or create rogue admin account