EUVD-2026-46149
GHSA-pfhx-5hrx-gx78
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS execution requires victim to navigate to the injected page (UI:R); contributor privilege required to store payload; scope change affects victim browser beyond vulnerable system.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
Technical ContextAI
The affected product is the Essential Addons for Elementor WordPress plugin by wpdevteam, identified by CPE cpe:2.3:a:wpdevteam:essential_addons_for_elementor_-_popular_elementor_templates_&_widgets:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the Stored variant. Source code references in the WordPress SVN repository pinpoint the vulnerable code paths to includes/Traits/Elements.php (L496), includes/Traits/Core.php (L185), and includes/Classes/Bootstrap.php (L145), all within the 6.6.10/6.6.11 tags. The Reading Progress Global Color Settings input is written to the WordPress database without adequate sanitization and rendered to page output without proper escaping, enabling persistent script injection that survives page reloads and affects all visitors.
RemediationAI
Upgrade to Essential Addons for Elementor version 6.7.0 or later, which contains the patch as confirmed by the WordPress.org SVN changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fessential-addons-for-elementor-lite/tags/6.6.11&new_path=%2Fessential-addons-for-elementor-lite/tags/6.7.0). The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/dde0cf3a-778b-4b5f-ac0e-600505d918ae provides additional remediation context. If immediate upgrade is not possible, the most effective compensating control is to audit and restrict contributor-level accounts - revoke contributor role from untrusted users, as this eliminates the attack surface entirely without modifying plugin configuration. Disabling the Reading Progress feature (if not in active use) would also eliminate the specific injection vector, though this may impact site UX. A WAF rule blocking script-tag patterns in color-setting parameters can provide detection and partial blocking but should not substitute for patching, as WAF evasion for XSS payloads is well-documented.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today