CVE-2025-26761: 
WordPress vulnerability analysis and mitigation

The Easy Elementor Addons WordPress plugin versions 2.1.5 and below contains a Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by researcher Gab and was publicly disclosed on February 14, 2025. This security issue affects users with Contributor-level privileges or higher (Patchstack).

The vulnerability has been assigned CVE-2025-26761 and received a CVSS score of 6.5, indicating a low to moderate severity level. The issue is classified under the OWASP Top 10 category A3: Injection, specifically as a Cross-Site Scripting (XSS) vulnerability. The security flaw involves improper neutralization of input during web page generation (Patchstack).

The vulnerability could allow malicious actors to inject harmful scripts, including redirects, advertisements, and other HTML payloads into affected websites. These injected scripts would be executed when visitors access the compromised site (Patchstack).

The vulnerability has been patched in version 2.1.6 of the Easy Elementor Addons plugin. Users are advised to update to version 2.1.6 or later to remediate the security issue. Patchstack users have the option to enable auto-updates for vulnerable plugins (Patchstack).