Stored XSS Vulnerability in Essential Addons for Elementor (CVE-2026-102394)

What Happened

A stored cross-site scripting vulnerability (CWE-79) was identified in Essential Addons for Elementor, affecting versions through 6.8.4. Stored XSS vulnerabilities allow an attacker to inject malicious script content that is saved by the application and later served to other users, potentially executing in their browsers.

Technical Cause

The vulnerability stems from improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). According to the CVSS vector, exploitation requires network access, low attack complexity, low-level privileges, and user interaction. The vulnerability affects confidentiality, integrity, and availability at a low impact level each, and the scope is changed, meaning the impact can extend beyond the vulnerable component itself.

Who Is Affected

Sites running Essential Addons for Elementor version 6.8.4 or earlier are affected. The plugin is reported to be installed on over one million WordPress sites, making this a widely relevant issue for site administrators using this plugin.

Affected Versions

The vulnerability affects Essential Addons for Elementor through version 6.8.4. The source data references version 6.8.5 in the plugin's title as a boundary marker, but the fact package does not confirm that 6.8.5 is a released, available fix. Fix availability is explicitly marked as unresolved in our data.

Fixes and Mitigation

Our fact package indicates that a fix is not confirmed as available at this time, despite version 6.8.5 appearing in the advisory title as a reference point. Administrators should monitor the official plugin changelog and update to the latest available version from the WordPress plugin repository as soon as a confirmed fix is released.

Recommended Action

Site administrators using Essential Addons for Elementor should check their currently installed version and monitor official plugin update channels closely. Until a confirmed fixed version is verified, consider restricting access to user roles capable of triggering the stored XSS condition, and review recently submitted content for suspicious script content.