{"id":"CVE-2026-110510","kind":"vulnerability","aliases":["CVE-2026-110510"],"related":[],"title":"Essential Addons for Elementor: authors can inject iframe and form markup","description":"The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.","summary":"The Essential Addons for Elementor WordPress plugin does not validate the HTML tag setting on some widgets before building markup. A user with the author role or higher can inject iframe and form elements into published pages.","severity":"low","cvss":3.5,"epss":0.00097,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-author-role-users","plugin-version-6.8.7-or-later"],"how_to_check":"- Check the installed plugin version of Essential Addons for Elementor in the WordPress admin plugins list; it should be `6.8.7` or later.\n- unknown","fix":"- Update Essential Addons for Elementor to `6.8.7` or later.","status":"open","published_at":"2026-10-23T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:45:34+00:00","updated_at":"2026-10-25T04:45:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:45:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update Essential Addons for Elementor to `6.8.7` or later.","reach":"network","title":"Essential Addons for Elementor: authors can inject iframe and form markup","impact":"low","summary":"The Essential Addons for Elementor WordPress plugin does not validate the HTML tag setting on some widgets before building markup. A user with the author role or higher can inject iframe and form elements into published pages.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Injected iframe and form elements on published pages, enabling phishing or clickjacking.","analyst_note":"","how_to_check":"- Check the installed plugin version of Essential Addons for Elementor in the WordPress admin plugins list; it should be `6.8.7` or later.\n- unknown","needs_analyst":false,"not_affected_if":["plugin-version-6.8.7-or-later","no-author-role-users"],"who_is_affected":"Sites running the Essential Addons for Elementor plugin before `6.8.7` that have users with the author role or higher. The risk is limited to injected iframe and form elements on published pages, so sites with no author-level accounts face less exposure. unknown for whether other configurations change exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000574,"input_tokens":3343,"output_tokens":480,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-110510':14A,17A '-2026':13A,16A '6.8.7':69C 'addon':2A,26B,63C 'allow':90C 'author':5A,48B,94C 'build':42B,86C 'could':89C 'cve':12A,15A 'element':57B,103C 'elementor':4A,18B,28B,65C 'essenti':1A,25B,62C 'form':10A,56B,102C 'higher':51B 'host':22B 'html':35B,74C 'ifram':8A,54B,100C 'inject':7A,53B,99C 'markup':11A,43B,87C 'packag':19B 'page':60B,106C 'plugin':30B,67C 'publish':59B,105C 'role':49B,95C 'self':21B 'self-host':20B 'set':37B,76C 'tag':36B,75C 'use':83C 'user':45B,91C 'valid':33B,72C 'widget':40B,81C 'wordpress':23B,29B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Addons for Elementor plugin before `6.8.7` that have users with the author role or higher. The risk is limited to injected iframe and form elements on published pages, so sites with no author-level accounts face less exposure. unknown for whether other configurations change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110510","severity":null,"published_at":"2026-10-23T06:17:05+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110510","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110510","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}