CVE-2026-6459

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions prior to 6.6.3

Description Stored Cross-Site Scripting (XSS) occurs in the Event Calendar widget due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 6.6.2. Restrict access to the Event Calendar widget for users with Author-level permissions until the update is applied.