Essential Addons Elementor EUVD-2026-42228

Exploitation requires an authenticated WordPress session at Author level or above - unauthenticated or Subscriber-level access is insufficient. Additionally, both the Essential Addons for Elementor plugin (version 6.6.2 or below) and The Events Calendar plugin must be installed and active, and at least one page must include the Event Calendar widget. The stored payload executes passively in victims' browsers when they visit the injected page - no further interaction from the attacker is required after the payload is planted. Exploitation is limited to WordPress installations that allow multiple author accounts or have exposed author registration; single-operator sites where no external parties hold Author-or-above access are not realistically exploitable from outside.

The CVSS 6.4 base score reflects a meaningful but bounded risk profile. PR:L confirms exploitation requires at minimum Author-level WordPress authentication, which substantially limits the attacker population to insiders, compromised accounts, or sites that permit open contributor/author registration. S:C and C:L/I:L acknowledge that once a payload is planted, it executes silently against all subsequent page visitors without further attacker involvement, enabling session hijacking or credential theft at scale. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed in active exploitation campaigns at time of analysis. The realistic risk is elevated on multi-author WordPress sites (blogs, news platforms, membership sites) where Author-level accounts are distributed broadly, and is lower on single-operator sites. The dependency on The Events Calendar plugin being installed and integrated adds an additional deployment constraint that the raw CVSS score does not capture.

An attacker holding or acquiring an Author-level WordPress account navigates to The Events Calendar and creates or edits an event, embedding a JavaScript payload such as a cookie-exfiltration script within the event title field. Essential Addons for Elementor's Event Calendar widget renders this unsanitized title on any page where the widget is placed, causing the script to execute silently in every visitor's browser and forwarding session tokens to an attacker-controlled endpoint.