Element Pack CVE-2026-105871

Exploitation requires an existing authenticated WordPress account with at least low-level privileges (PR:L) capable of submitting content through an Element Pack Elementor widget or input field in versions up to and including 8.8.6, where input is improperly neutralized before web-page generation. Execution additionally requires user interaction (UI:R): a victim - typically an administrator or other user - must view the page containing the stored payload for the script to fire. Limiting factors: the attacker cannot be fully anonymous (no PR:N), the plugin must be installed and the vulnerable widget/feature in use, and successful compromise depends on a higher-privileged user rendering the injected content.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) indicates a network-reachable but privilege-and-interaction-gated flaw: an attacker needs an existing authenticated low-privilege WordPress account (PR:L) and a victim must view the malicious content (UI:R). The scope change (S:C) and partial C/I/A impacts reflect typical stored-XSS behavior where injected script executes in a victim's browser session, potentially under a higher-privileged admin context. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation - status is 'no public exploit identified at time of analysis.' Signals are internally consistent (no CVSS-vs-description conflict), but exploitation probability data (EPSS) is entirely missing, limiting quantitative risk ranking. Stored XSS in a popular Elementor addon is realistically exploitable in multi-author WordPress environments but is gated by the requirement for a pre-existing contributor/author account and admin interaction, keeping real-world risk moderate rather than critical.

An authenticated low-privilege user (e.g., contributor or author) on a WordPress site running Element Pack injects a malicious script payload through a vulnerable plugin input/widget that is stored and later rendered. When an administrator or other user views the affected page or post, the script executes in their browser, enabling session hijacking or actions in the admin context. No public exploit code was identified in the provided data.