CVE-2026-15145: Essential Addons for Elementor <= 6.6.11 - Malicious Code Injection

Summary

The Essential Addons for Elementor plugin has a security flaw that allows an attacker with some level of access to insert malicious code into website pages. This code can run whenever a user visits the affected page, potentially causing harm to the website or its visitors. Update the plugin to a version higher than 6.6.11 to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
wpdevteam	essential addons for elementor – popular elementor templates & widgets	<= 6.6.11

Original title

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and includi...

Original description

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

mitre CVSS3.1 6.4

Vulnerability type

CWE-79 Cross-site Scripting (XSS)