Low · 3.1 WordPress CVE-2026-110510 CVE-2026-110537
Essential Addons for Elementor before 6.8.7: Two Low-Severity Access Control Flaws
The Essential Addons for Elementor WordPress plugin, used on over a million sites, contains two low-severity vulnerabilities fixed in version 6.8.7: an unvalidated HTML tag setting that lets Author-level users inject iframe/form markup, and a Multisite authorization gap that lets subsite administrators alter the login-approval state of accounts on other sites in the network.
AI summary
Two vulnerabilities have been disclosed in Essential Addons for Elementor, a WordPress plugin used on more than a million sites according to WPVulnerability data. Both issues are tracked as fixed in version 6.8.7 and were published on October 23, 2026. Neither vulnerability is rated as high severity, and both require an attacker to already hold an elevated role on the site.
What Happened
Two separate CWE-classified issues were identified in Essential Addons for Elementor. CVE-2026-110510 involves a failure to validate the HTML tag setting used by some of the plugin's widgets before it is used to build page markup. CVE-2026-110537 involves an authorization check that only verifies a site-level capability rather than confirming that an administrator is permitted to manage the specific user account targeted by the plugin's login-approval feature.
Technical Cause
CVE-2026-110510 is classified under CWE-345 (Insufficient Verification of Data Authenticity), reflecting that the HTML tag setting is not validated before being used to generate markup, allowing iframe and form elements to be injected into published pages. CVE-2026-110537 is classified under CWE-863 (Incorrect Authorization): the login-approval feature checks only whether a user holds a general site-level capability, not whether that administrator actually manages the specific account being modified. On WordPress Multisite installations, this allows the authorization check to pass incorrectly across network boundaries.
Who Is Affected
For CVE-2026-110510, sites are affected where users holding the Author role or above can edit pages using the plugin's widgets; such users could inject iframe and form elements into published content. For CVE-2026-110537, only WordPress Multisite networks are affected, where a subsite administrator could change the approval and login state of accounts belonging to other sites on the same network.
Affected Versions
Essential Addons for Elementor versions before 6.8.7 are affected by both CVE-2026-110510 and CVE-2026-110537.
Fixes and Mitigation
Both advisories reference version 6.8.7 as the fixed version in the affected-range data. The fact package does not confirm that a patched release has been publicly published or is available for download; the 'fix_available' indicator in the source data for both advisories is marked false. Site owners should check the plugin's changelog and update to version 6.8.7 or later once confirmed available.
Recommended Action
Administrators should verify their installed version of Essential Addons for Elementor and update to version 6.8.7 or later as soon as a confirmed update is available. As a general precaution, review which users hold the Author role or above and restrict access to widget editing where not needed. For WordPress Multisite networks, review subsite administrator permissions related to the plugin's login-approval feature.
PatchBriefing score
3.1 / 10 · Low
Official CVSS: 3.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
EPSS 0.0013 (3 percentile)
Why this score
Both vulnerabilities carry low CVSS base scores (3.5 and 3.8) and low Patchwire scores (2.7 and 3.1). Both require privileged access (PR:H, an Author role or site-level administrator), limiting exploitability to users who already have meaningful access to the site. Neither is known to be actively exploited, and no public exploit code has been reported. EPSS scores for both are very low (under 0.2%), indicating a low predicted likelihood of exploitation. The lack of a confirmed available fix contributes a small amount to the score, as does the plugin's large install base (over one million active installs), which increases the overall population of potentially affected sites.
Affected versions
- Essential Addons for Elementor < 6.8.7
- vulnerable
- Essential Addons for Elementor < 6.8.7
- vulnerable
Reported fixes
Both advisories reference version 6.8.7 as the fixed version in the affected-range data. The fact package does not confirm that a patched release has been publicly published or is available for download; the 'fix_available' indicator in the source data for both advisories is marked false. Site owners should check the plugin's changelog and update to version 6.8.7 or later once confirmed available.
How this was built
4 source records were collected, matched and used to prepare the report above.
-
NVD (NIST) database
-
WPVulnerability database
-
-
Revision history
- Published
- Generated
Related
Relevant changes for the stacks you follow.
Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.
✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email