CVE-2026-6459 is a Stored Cross-Site Scripting vulnerability in Essential Addons for Elementor Lite through version 6.6.2. An authenticated Author or higher-privileged user who can publish The Events Calendar events and assign a featured image can save a crafted event title. Opening that event in the EA Event Calendar popup with a Body Left or Body Right thumbnail executes an injected image load handler in the viewing browser, including an administrator’s session. The issue is fixed in version 6.6.3.
| CVE | CVE-2026-6459 |
| Plugin Version | Essential Addons for Elementor Lite <= 6.6.2, fixed in 6.6.3 |
| All Time | 135 091 427 |
| Active installations | 1 000 000+ |
| Publicly Published | July 7, 2026 |
| Last Updated | July 8, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 Cross-Site Scripting |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-6459 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/essential-addons-for-elementor-lite/essential-addons-for-elementor-662-authenticated-author-stored-cross-site-scripting-via-event-calendar-widget-popup |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| March 10, 2026 | Plugin testing and vulnerability detection in Essential Addons for Elementor Lite were completed. |
| March 10, 2026 | The vulnerability report was sent with the PoC, technical description, and recommendations for remediation. |
| July 7, 2026 | Wordfence publicly published the advisory for CVE-2026-6459. |
| July 8, 2026 | The CVE-2026-6459 record was published in the CVE Program registry. |
Discovery of the Vulnerability
The affected path is the EA Event Calendar widget when its source is The Events Calendar, its layout is Calendar, and popup thumbnails are shown in the Body Left or Body Right position. The widget reads the underlying event post’s post_title into event.title. The frontend popup builder then concatenates that value directly into the alt attribute of an <img> element without attribute escaping.
A double quote in the saved title closes the intended attribute value. The remaining title text can then introduce an onload attribute that runs when the featured image loads in the popup. The title belongs to the underlying The Events Calendar event record rather than _elementor_data, so filtering Elementor’s own saved widget data does not neutralize this input path. The source event must remain untrusted when the popup constructs HTML.
Understanding of Stored Cross-Site Scripting attacks
Stored Cross-Site Scripting occurs when saved input is later interpreted as executable markup by another user’s browser. Here, the attacker controls an event title, while the popup places it inside an HTML attribute. Data that is harmless when displayed as text still needs context-appropriate handling when reused in an attribute.
The reported access level is Author or higher, with permission to create or publish The Events Calendar events and attach a featured image. The victim must open the crafted event’s popup in the affected configuration. If an administrator opens it while signed in, the script runs under the site’s origin in that browser and may access exposed data or perform actions available to the viewing session. Administrative compromise is a possible consequence rather than a direct server-side execution primitive.
Exploiting the Stored Cross-Site Scripting Vulnerability
Use an isolated WordPress test site with Elementor, The Events Calendar, and an affected release of Essential Addons for Elementor Lite. Sign in as an Author or another account with the required event and media permissions. The supplied PoC uses an alert to demonstrate JavaScript execution without changing site data.
POC:
POC: Account - Author or higher with permission to publish The Events Calendar events 1) Create a new The Events Calendar event and set its title to x" onload="alert(document.domain) 2) Assign any featured image to the event and publish it. 3) On a test page, configure the Essential Addons Event Calendar widget Source = The Events Calendar Layout = Calendar Popup Thumbnail = Show Thumbnail Position = Body Left or Body Right 4) Open the page as another user and click the crafted event. 5) The popup opens and the image onload handler displays alert(document.domain).____
The featured image is required for this demonstration because the injected handler is attached to the popup image. The alert appears when the crafted event’s popup opens and that image loads. The payload persists in the saved event title, so later visitors can encounter it until the title is cleaned or the vulnerable output path is removed.
Recommendations for Improved Security
Update Essential Addons for Elementor Lite to 6.6.3 or a newer patched release, preferably the current supported release. Review existing The Events Calendar titles for unexpected attribute or event-handler text. If an update is temporarily unavailable, disable the affected event popup thumbnails or remove the affected widget from public pages and limit event creation to trusted accounts.
Developers should avoid building an image element by concatenating an untrusted title into an HTML string. Create the element through DOM APIs and set its alt value as text, or apply attribute escaping at the final HTML construction point. Check both Body Left and Body Right branches and test titles containing quotes, angle brackets, ampersands, and event-handler text. Validation of Elementor data alone cannot protect titles supplied by another plugin’s event records.
Fixing CVE-2026-6459 keeps event titles as text when a calendar popup builds its thumbnail. Escaping data at that final output boundary protects visitors and administrators who open saved events.
#WordPressSecurity #StoredXSS #EssentialAddons #PluginSecurity #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
