---
id: CVE-2026-110510
title: >-
  Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing
  Table and Post Timeline Title Tag
summary: >-
  The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not
  validate the HTML tag setting of some of its widgets before using it to build
  markup, which could allow users with the author role and above to inject
  iframe and …
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-345
product: Essential Addons for Elementor
affected:
  - essential_addons_for_elementor < 6.8.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T10:45:33.438813Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:45:37.284Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110510'
references:
  - url: 'https://wpscan.com/vulnerability/ae0793fa-0223-40d9-836e-f9c6a0fbf80f/'
tags:
  - cve.org
ingestedAt: '2026-10-23T06:17:25.173Z'
---

## Overview

The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

## Affected

- `essential_addons_for_elementor < 6.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.