CVE-2026-110508

MediumCVSS 5.3/10Last modified Oct 28, 2026

Description

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Essential Addons for Elementor	>= 6.7.3, < 6.8.7

References

https://wpscan.com/vulnerability/77c4b22a-b1c2-4b65-b98c-e07489f94864/

Timeline

Published: Oct 28, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1105095.3The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor c CVE-2026-110516.5Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive infor CVE-2026-1105103.5The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using CVE-2026-1105144.9The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and CVE-2026-1105165.5The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attri CVE-2026-110529.6Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process CVE-2026-1105238.1The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment ga CVE-2026-1105246.8The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storin CVE-2026-1105258.8The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in th CVE-2026-1105275.3The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration wh CVE-2026-1105307.2The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicat CVE-2026-1105328.6The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement