Essential Addons for Elementor <= 6.6.11 Authenticated Stored XSS via Reading Progress Settings (CVE-2026-15156)

Vulnerability Summary Vulnerability Name: Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings CVE ID: CVE-2026-15156 CVSS Score: 6.4 (Medium) Disclosure Date: July 20, 2026 Last Updated: July 21, 2026 Researcher: Jonah Burgess (CryptoCat) Impact Scope Affected Versions: Essential Addons for Elementor <= 6.6.11 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Attack Conditions: Requires authentication at the Contributor+ level Vulnerability Description: Due to insufficient input sanitization and output escaping, arbitrary web scripts can be injected into the "Reading Progress Global Color Settings" and executed when users access pages containing the injected script. Remediation Fixed Version: 6.7.0 Recommendation: Upgrade to version 6.7.0 or higher to fix this vulnerability. Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Vulnerabilities Recent vulnerabilities in Essential Addons for Elementor – Popular Elementor Templates & Widgets: - CVE-2026-15145: Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget - CVE-2026-15155: Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection - CVE-2026-6459: Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup - CVE-2026-7665: Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via load_more AJAX Handler - CVE-2026-5193: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user - CVE-2026-25440: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.6.0 - Missing Authorization - CVE-2026-1512: Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget - CVE-2026-1004: Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure - CVE-2025-69092: Essential Addons for Elementor <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE-2025-13977: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Notes Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence Intelligence WordPress vulnerability database: Fully free to access and use, containing all the same vulnerability data. Contact Contact Email: support@wordfence.com Copyright Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Email Footer Information Business hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE-Request Form Subscribe for Updates Sign up for news and updates from our panel of experienced security professionals. Copyright Notice © 2012-2026 Defiant Inc. All Rights Reserved Additional Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence Intelligence WordPress vulnerability database: Fully free to access and use, containing all the same vulnerability data. Contact Contact Email: support@wordfence.com Copyright Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Email Footer Information Business hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE-Requ

Goal Reached Thanks to every supporter — we hit 100%!

Essential Addons for Elementor <= 6.6.11 Authenticated Stored XSS via Reading Progress Settings (CVE-2026-15156)