Published October 23, 2026. Based on public CVE records available on that date; details may change.

Two vulnerabilities published on October 23, 2026 affect the Essential Addons for Elementor WordPress plugin in all versions before 6.8.7. CVE-2026-110510 lets users with the author role or above inject iframe and form elements into published pages, and CVE-2026-110537 lets a subsite administrator on WordPress Multisite change the login-approval state of accounts on other sites in the network. Update the plugin to 6.8.7 or later, then review recent author content and, on Multisite, user approval states.

What happened

Both issues were published by WPScan, the CVE numbering authority named on the records, and both list the same affected range: versions before 6.8.7.

CVE-2026-110510 is a content injection issue. The record says the plugin "does not validate the HTML tag setting of some of its widgets before using it to build markup." The record title names the Pricing Table and Post Timeline widgets. In plain terms, a widget setting meant to hold a heading tag name (for example h2) was not checked against a list of safe values, so someone who can edit pages could use it to place an iframe or form element in a published page. An injected form could be used to collect information from visitors under the site's own address, and an injected iframe could load content from another site.

CVE-2026-110537 is an authorization issue in the plugin's login-approval feature. The record says the plugin checks only a site-level capability, not whether that administrator may manage the specific user accounts being changed. On WordPress Multisite, that could allow a subsite administrator to change the approval and login state of accounts that belong to other sites on the network. The record title connects it to a bulk action.

Neither CVE record includes a CVSS score, so we are not publishing one here. The records reviewed for this article do not mention exploitation in the wild.

Who is affected

Any site running Essential Addons for Elementor before 6.8.7 is affected by CVE-2026-110510 if it has users at the author level or above who are not fully trusted. That includes membership sites, multi-author blogs, and agency-built sites where clients or contractors hold author or editor accounts.

CVE-2026-110537 matters for WordPress Multisite networks where subsite administrators are different people from the network's Super Admins. A single-site install does not have that boundary, but it should still update because the same release covers the first issue.

The free plugin is listed on WordPress.org under the slug essential-addons-for-elementor-lite, with 1,000,000+ active installations on WordPress.org as of October 23, 2026. Version 6.8.7 was the current release on WordPress.org on that date. Its changelog entry for 6.8.7 lists a library update and bug fixes but does not name these CVEs, so rely on the version number rather than the changelog wording. The CVE records name only the "Essential Addons for Elementor" product; if you also run the separately licensed Pro add-on, check the vendor's account area and changelog for any related guidance.

How to check your site

Start with the version number. In the WordPress dashboard, open Plugins and look for Essential Addons for Elementor. If the version shown is lower than 6.8.7, the site is affected.

With WP-CLI, from the WordPress directory:

  • wp plugin list --name=essential-addons-for-elementor-lite --fields=name,status,version shows the installed version.
  • wp plugin update essential-addons-for-elementor-lite installs the latest release from WordPress.org.
  • On Multisite, add --network where appropriate, and run wp site list to see which subsites exist.

Then look at who could have used the issues:

  1. In Users, filter by Author, Editor, and Administrator. Every account should belong to a known person. Our guide to finding hidden WordPress admin users covers accounts that do not show up in the normal list.
  2. Review pages and posts edited recently by author-level users, especially any that use the Pricing Table or Post Timeline widgets. Look at the published page in a private browser window for unexpected embedded frames or forms.
  3. On Multisite, review the login-approval status of users across subsites. Accounts that were approved or blocked without a clear reason deserve a closer look.

An affected version on its own is not evidence of compromise. If you do find a form or frame no one on your team added, treat it as a possible incident and see how to fix a hacked WordPress site before deleting anything.

What to do now

Update Essential Addons for Elementor to 6.8.7 or later. Use Dashboard, Updates, the Plugins screen, or the WP-CLI command above. If you test updates on staging first, keep the gap between staging and production short for this one.

After updating:

  • Remove author, editor, and administrator accounts that are no longer needed. The author-level requirement in CVE-2026-110510 makes account hygiene the main control while a site is unpatched.
  • Remove any injected iframe or form from affected pages, and keep a copy of what you found (a screenshot and the page revision) before you remove it.
  • On Multisite, confirm that only Super Admins you trust have network-level control, and that subsite administrators have only the access they need.
  • If you find injected content, rotate passwords for accounts that edited the affected pages and check for other changes. Our WordPress hardening checklist lists the account and update controls that limit this kind of issue.

When to get help

Get help if you find content, forms, or account changes you cannot explain, or if you manage a Multisite network and are unsure which subsite administrators had access. A security audit can review user roles and plugin exposure across your sites, and WordPress malware removal is the right starting point if you see signs of a compromise.

Sources