CVE-2026-13344 Overview
CVE-2026-13344 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin versions prior to 6.6.10. The plugin fails to validate the HTML tag name of the Pricing Table widget title before rendering it in the page output. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript that executes when the affected page is viewed. Execution occurs in the browser session of any visitor, including administrators previewing or visiting the post, enabling session theft, privilege escalation, and administrative account compromise.
Critical Impact
Contributor-level accounts can escalate to administrator by injecting JavaScript that executes in an admin's browser session.
Affected Products
- Essential Addons for Elementor WordPress plugin versions prior to 6.6.10
- WordPress sites running the plugin with Contributor-level or higher user registration enabled
- Elementor-based sites that use the Pricing Table widget
Discovery Timeline
- 2026-07-30 - CVE-2026-13344 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13344
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw [CWE-79] in the Pricing Table widget of Essential Addons for Elementor. The widget accepts a user-controlled HTML tag name for the title element without validating it against an allowlist of safe tags. An authenticated Contributor can supply an arbitrary tag, such as script, or a tag that carries event-handler attributes, causing browser execution of attacker JavaScript.
The payload is stored in the post's Elementor page data and rendered whenever the page is loaded. Because WordPress posts are commonly reviewed by editors and administrators before publication, the payload is highly likely to fire in a privileged session. Successful exploitation permits session cookie theft, forced administrative actions through the WordPress REST API, and creation of new administrator accounts.
Root Cause
The plugin does not validate or sanitize the HTML tag name attribute for the Pricing Table title before writing it into the rendered output. The plugin authors expect a heading tag such as h1 through h6, but the input is not restricted to that set. Missing tag-name allowlisting combined with lack of output encoding produces the stored XSS condition.
Attack Vector
An authenticated attacker with Contributor privileges edits a post containing an Essential Addons Pricing Table widget. The attacker sets the title's HTML tag field to a value that introduces script execution, saves the post, and submits it for review. When an editor or administrator previews or visits the post, the injected JavaScript executes in that user's authenticated session. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-13344
Indicators of Compromise
- Elementor post metadata containing unexpected HTML tag names such as script, img, or svg in Pricing Table title configuration fields.
- New WordPress user accounts with administrator or editor roles created shortly after a Contributor submitted a post for review.
- Outbound requests from admin browser sessions to attacker-controlled domains immediately after previewing a post.
Detection Strategies
- Audit the wp_postmeta table for Elementor data containing <script, onerror=, or onload= substrings inside Pricing Table widget settings.
- Review WordPress audit logs for posts saved by Contributor-level users that include Essential Addons widgets.
- Compare installed Essential Addons for Elementor plugin versions against 6.6.10 and flag any host below that version.
Monitoring Recommendations
- Enable a WordPress activity log that records post revisions, user role changes, and administrator account creation events.
- Monitor web server access logs for administrator sessions loading preview URLs authored by low-privilege users.
- Alert on plugin file modifications and on any REST API calls to /wp-json/wp/v2/users that create privileged accounts.
How to Mitigate CVE-2026-13344
Immediate Actions Required
- Update Essential Addons for Elementor to version 6.6.10 or later on every affected WordPress site.
- Review all posts and templates that use the Pricing Table widget and remove any unexpected tag names or embedded scripts.
- Audit user accounts and revoke Contributor or higher access for users that do not require it.
Patch Information
The vendor addressed the issue in Essential Addons for Elementor version 6.6.10 by validating the HTML tag name for the Pricing Table widget title against an allowlist of permitted heading tags. Site administrators should apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for the vendor's fix reference.
Workarounds
- Temporarily disable the Essential Addons for Elementor plugin until the patched version can be deployed.
- Restrict Contributor and Author roles from editing posts that use Essential Addons widgets by adjusting role capabilities.
- Deploy a web application firewall rule that blocks POST requests containing unexpected HTML tag values in Elementor widget payloads.
# Update Essential Addons for Elementor using WP-CLI
wp plugin update essential-addons-for-elementor-lite --version=6.6.10
wp plugin list --name=essential-addons-for-elementor-lite --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
