Element Pack CVE-2026-108478

Exploitation requires an authenticated WordPress user with at least low-level content-editing privileges (PR:L, e.g. contributor/author) capable of supplying input to a vulnerable Element Pack Elementor widget/field, plus victim user interaction (UI:R) - a higher-privileged user such as an administrator must subsequently render the page containing the stored payload for the script to fire. Limiting factors: this is not remote-unauthenticated; it depends on the attacker already having an account on the target site and on an admin viewing the malicious content. It affects Element Pack Elementor Addons versions up to and including 8.8.8 on WordPress sites running this plugin.

This is a moderate-severity Stored XSS (CWE-79) in the BdThemes Element Pack Elementor Addons WordPress plugin, rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals point to a real but conditional risk rather than an urgent emergency. The CVSS vector requires authenticated access (PR:L - typically a contributor/author-level account able to edit Elementor content) plus victim interaction (UI:R - an administrator or other user must render the poisoned page), which substantially raises the bar versus a true unauthenticated RCE. The scope change (S:C) and the low Confidentiality/Integrity/Availability impacts are consistent with script execution crossing a security boundary into an admin's authenticated browser session. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public proof-of-concept referenced - the sole source is a Patchstack database entry - so this should be treated as 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net assessment: a legitimate patch-worthy issue typical of the large volume of Patchstack-reported WordPress plugin XSS flaws, but it is authenticated and interaction-dependent, so it is lower priority than unauthenticated or actively-exploited vulnerabilities absent any EPSS/KEV signal to the contrary.

An attacker holding a low-privileged WordPress account (e.g., contributor/author) that can edit Elementor widgets injects a malicious script payload into an improperly sanitized Element Pack field. The payload is stored and later executes in the browser of an administrator who views or edits the affected page, enabling session hijacking or actions in the admin context. No public exploit code is referenced, and successful exploitation depends on the victim rendering the stored content.