EUVD-2026-46166
GHSA-fvc5-h4x4-cfv4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor account required (PR:L); stored payload auto-executes on page load without special victim action (UI:N); cross-browser scope change applies (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe innerHTML assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Technical ContextAI
The affected product (CPE: cpe:2.3:a:wpdevteam:essential_addons_for_elementor_-_popular_elementor_templates_&_widgets:*:*:*:*:*:*:*:*) bundles the Morphext.js library for its Fancy Text Widget, which cycles through animated text phrases. Pre-patch, the library's animate() function wrote user-controlled content into the DOM via this.element[0].innerHTML, concatenating both the CSS animation class name and the phrase text into a raw HTML string - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern. A second injection point existed in fancy-text.js, where the fancy-text-transition-type data attribute was read from the DOM and forwarded directly to Morphext as an animation class string without validation against a known-good list. The fix, visible in commit d88e08257, replaced innerHTML with safe DOM API calls (createElement, textContent, classList.add) and introduced an explicit ALLOWED_TRANSITIONS allowlist in fancy-text.js covering only legitimate animation names such as 'fadeIn', 'bounceIn', and 'zoomIn'. The plugin runs inside Elementor on WordPress, meaning the attacker's content is stored server-side in post meta and rendered to all subsequent page visitors.
RemediationAI
Upgrade Essential Addons for Elementor to version 6.7.0 or later immediately; this is the vendor-released patch confirmed in commit d88e08257 (https://github.com/wpdevelopers/essential-addons-for-elementor-lite/commit/d88e08257) and the WordPress.org changeset between tags 6.6.11 and 6.7.0. The patch replaces unsafe innerHTML usage with DOM-safe APIs and restricts animation class names to a validated allowlist, closing both injection sinks. If upgrade is not immediately feasible, restrict WordPress contributor-level role assignment to trusted users only and audit existing contributor accounts - this eliminates the required authenticated attack vector. As a secondary control, the Fancy Text Widget can be disabled within the Essential Addons settings panel; note this will break any page layouts using that widget and require content rework. Generic WAF rules targeting <script> tags in POST bodies offer minimal protection here since the payload is stored in WordPress post meta rather than reflected from a URL parameter. See the full advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2100d720-bfb4-451d-9907-e0b77ef507a5.
Authenticated account takeover in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.10) lets a Contrib
Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows
Stored Cross-Site Scripting in Essential Addons for Elementor (versions up to and including 6.6.2) allows authenticated
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today