The vulnerability exists in Essential Addons for Elementor WordPress plugin versions prior to 6.8.7, where the plugin fails to validate the HTML tag setting chosen by users. This omission allows users with the author role or higher to supply arbitrary tags such as iframes and forms. When the widget renders, the supplied tags are inserted directly into the page markup, enabling an attacker to embed malicious content that is displayed to visitors. The result can be a cross‑site scripting attack or the injection of unauthorized form elements that could collect sensitive data.

Any WordPress site that has the Essential Addons for Elementor plugin installed and has a user account of author level or above is affected. The vulnerable product is the Essential Addons for Elementor plugin before version 6.8.7; no other WordPress core or plugin versions are listed as impacted.

The CVSS score is not provided and EPSS is not available, so the precise exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. Exploitation requires legitimate author or higher privileges; therefore, sites with loosely restricted author capabilities have a wider attack surface. When exploited the primary risk is XSS and the potential for defacement or data exfiltration via injected iframes or forms.