The Essential Addons for Elementor WordPress plugin, when used in versions prior to 6.8.7, fails to validate the HTML tag setting supplied by widget users. An author or higher role can therefore specify arbitrary tags, such as iframes or forms, and these tags are inserted directly into the page markup. This permits the attacker to embed custom content that is rendered to site visitors, potentially exposing malicious payloads or collecting data. The vulnerability arises from a lack of input validation (CWE‑345).

Every WordPress site that runs the Essential Addons for Elementor plugin with a version below 6.8.7 and has user accounts at the author level or higher is affected. No other WordPress core or plugin versions are listed as impacted.

The CVSS score of 3.5 indicates low severity, and the EPSS score of less than 1% points to a very low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires the attacker to possess author or higher privileges; thus sites that allow authors to edit widget HTML tags have a broader attack surface. The likely attack vector is the author’s ability to edit widget settings, and the potential impact includes the display of malicious iframes or forms to visitors. It is inferred that the injected content could be used for phishing, defacement, or data capture, but such outcomes are not explicitly documented in the description.