---
id: "CVE-2026-110510"
kind: "vulnerability"
aliases: ["CVE-2026-110510"]
title: "Essential Addons for Elementor: authors can inject iframe and form markup"
severity: "low"
cvss: 3.5
epss: 0.00097
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-author-role-users", "plugin-version-6.8.7-or-later"]
published_at: "2026-10-23T06:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:45:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110510", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110510", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Essential Addons for Elementor: authors can inject iframe and form markup

The Essential Addons for Elementor WordPress plugin does not validate the HTML tag setting on some widgets before building markup. A user with the author role or higher can inject iframe and form elements into published pages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version of Essential Addons for Elementor in the WordPress admin plugins list; it should be `6.8.7` or later.
- unknown

## Fix

- Update Essential Addons for Elementor to `6.8.7` or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110510
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110510

## From the sources

The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_