CVE-2026-13344 — MEDIUM (4.8)

Vulnerability Description

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

CVSS Score

4.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/d212286d-e152-4bfa-a9e4-a4940ec4adf9/

FAQ

What is CVE-2026-13344?

CVE-2026-13344 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level acc...

How severe is CVE-2026-13344?

CVE-2026-13344 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-13344?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.