What is the CVSS score of CVE-2026-13344?

CVE-2026-13344 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-13344?

Yes, a public proof-of-concept exploit is available for CVE-2026-13344. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-13344?

Yes, a patch is available for CVE-2026-13344. Update the affected software to the latest version immediately.

Essential Addons for Elementor CVE-2026-13344

EUVD-2026-51011 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 WPScan

GHSA-wqx2-q6jg-7j96

WordPress XSS Essential Addons For Elementor Unknown

4.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L better reflects Contributor as a low-privilege role; all other metrics match the described stored XSS with scope change to admin session.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:34 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

4.8 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 4.8

DescriptionCVE.org

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

AnalysisAI

Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher user to inject arbitrary JavaScript via an unsanitized HTML tag name in the Pricing Table widget title field. The payload executes in the browser of any user who views the affected page - critically including administrators previewing or visiting the post - enabling session hijacking or privilege escalation to full site control. A publicly available proof-of-concept exists, raising the realistic threat above the CVSS 4.8 medium score.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The affected component is the Pricing Table widget provided by the Essential Addons for Elementor plugin (CPE: cpe:2.3:a:unknown:essential_addons_for_elementor:*:*:*:*:*:*:*:*), a widely-used Elementor page-builder addon for WordPress. The root cause is a failure to validate or sanitize the HTML tag name submitted for the widget's title element before rendering it into the DOM. Because the tag name is reflected into server-generated HTML rather than a JavaScript context, allowlist-based output encoding is necessary but absent, permitting an attacker to substitute a legitimate tag name (e.g., 'h2') with a payload that triggers JavaScript execution (e.g., a crafted element or event attribute). The scope change (S:C in CVSS) reflects that the injected code runs in the victim's browser, a separate security principal from the plugin's own origin.

RemediationAI

Upgrade Essential Addons for Elementor to version 6.6.10 or later, which resolves the missing tag name validation in the Pricing Table widget. The vendor-released patch is confirmed available; update via the WordPress admin dashboard (Plugins → Updates) or via WP-CLI with 'wp plugin update essential-addons-for-elementor'. If immediate patching is not possible, restrict the Contributor and Author roles from creating or editing pages that include the Pricing Table widget, either through role capability management plugins or by removing the Contributor role's 'edit_posts' capability for relevant post types - note this limits legitimate contributor workflows. Alternatively, temporarily disable the Essential Addons for Elementor plugin entirely if the Pricing Table widget is not in active use, accepting the trade-off of losing all plugin functionality. The WPScan advisory is available at https://wpscan.com/vulnerability/d212286d-e152-4bfa-a9e4-a4940ec4adf9/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13344.