CVE-2026-6459: Essential Addons Elementor XSS Vulnerability

CVE-2026-6459 Overview

CVE-2026-6459 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Essential Addons for Elementor plugin for WordPress. The flaw exists in the Event Calendar widget across all versions up to and including 6.6.2. Insufficient input sanitization and output escaping on event titles sourced from The Events Calendar allow authenticated attackers with Author-level access or higher to inject arbitrary JavaScript. The injected payload executes whenever a user views an affected page.

Critical Impact
Authenticated Author-level attackers can inject persistent JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, account takeover, and further site compromise.

Affected Products

Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress
All versions up to and including 6.6.2
Event Calendar widget integration with The Events Calendar

Discovery Timeline

2026-07-08 - CVE-2026-6459 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-6459

Vulnerability Analysis

The vulnerability resides in the Event Calendar widget component of Essential Addons for Elementor. The widget pulls event titles from The Events Calendar plugin and renders them within Elementor-generated pages. The plugin fails to sanitize input on write and does not escape output on render, allowing raw HTML and script tags to persist in event titles. When a visitor loads a page containing the widget, the browser parses the malicious title as executable JavaScript in the context of the WordPress site origin.

Root Cause

The root cause is missing input sanitization and improper output escaping on event title fields consumed from The Events Calendar data source. The widget should apply WordPress escaping functions such as esc_html() or wp_kses_post() before rendering user-controlled content. Because event titles can be created by any user with Author-level or higher permissions, the trust boundary is too permissive for unsanitized HTML.

Attack Vector

An authenticated attacker holding Author-level access or above creates or edits an event through The Events Calendar and injects a JavaScript payload into the event title. When any page containing the Essential Addons Event Calendar widget renders that event, the payload executes in the browser of every viewer. The scope change indicates the injected script can affect resources beyond the vulnerable component, including administrative sessions.

See the Wordfence Vulnerability Report and CleanTalk CVE Analysis for technical details on the injection sink.

Detection Methods for CVE-2026-6459

Indicators of Compromise

Event titles in The Events Calendar containing HTML tags such as <script>, <img onerror=, or <svg onload=
Unexpected outbound requests from visitor browsers to attacker-controlled domains when viewing calendar pages
New or modified administrator accounts created shortly after Author-level users edit events
Unexpected changes to plugin settings, themes, or user roles following calendar page access

Detection Strategies

Audit the WordPress posts table for event post types containing HTML or JavaScript in the post_title field
Review Author-level user activity logs for event creation or modification events preceding suspicious admin actions
Deploy Content Security Policy (CSP) reporting to identify script execution from inline event content
Scan rendered calendar pages for embedded scripts using automated web crawlers

Monitoring Recommendations

Monitor WordPress audit logs for post_updated and post_inserted events on tribe_events post types
Alert on any authenticated user account escalating privileges or creating new administrators
Track outbound network requests from browser sessions loading WordPress admin or calendar pages
Enable web application firewall logging for requests containing HTML entities in event-related endpoints

How to Mitigate CVE-2026-6459

Immediate Actions Required

Update Essential Addons for Elementor to a version later than 6.6.2 once released by the vendor
Audit all existing event titles for embedded HTML or JavaScript and sanitize any malicious content
Review Author-level and higher user accounts, removing untrusted or dormant accounts
Restrict the ability to create or edit events to trusted editorial roles until patching is complete

Patch Information

The vendor addressed the vulnerability in the plugin repository. Review the WordPress Plugin Update changeset for the code changes that add proper sanitization and escaping to the Event Calendar widget. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Disable the Essential Addons Event Calendar widget on all Elementor pages until the update is applied
Deactivate the Essential Addons for Elementor plugin if the Event Calendar functionality is not required
Implement a Content Security Policy that blocks inline script execution on pages rendering calendar widgets
Reduce user roles capable of creating events to Editor or Administrator only via a role management plugin

bash

# Update the plugin via WP-CLI
wp plugin update essential-addons-for-elementor-lite

# Verify installed version
wp plugin get essential-addons-for-elementor-lite --field=version

# Search for potentially malicious event titles
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_type='tribe_events' AND (post_title LIKE '%<script%' OR post_title LIKE '%onerror=%' OR post_title LIKE '%onload=%');"