PowerPack Addons CVE-2026-108488

Exploitation requires an authenticated WordPress account with at least the capability to create or edit content using a PowerPack for Elementor widget (PR:L - typically contributor/author level), on a site running PowerPack Addons for Elementor version 3.1.0 or earlier. The payload is stored, so execution is deferred and requires a second privileged user to view the affected content (UI:R). Limiting factors: single-author or admin-only sites with no untrusted lower-privileged users have little exposure; the attacker cannot trigger the payload themselves against a victim without that victim loading the content, and no unauthenticated path exists.

This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but authenticated (PR:L) stored XSS that also requires victim interaction (UI:R) - a privileged user must load the page containing the injected payload. These two gating conditions meaningfully lower real-world risk versus the raw score. No EPSS probability was supplied in the input, there is no CISA KEV listing (not actively exploited), and no public exploit code (POC) was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The single source is a Patchstack advisory. The S:C (scope change) reflects that injected script executes in the browser context of another user (e.g. an admin), which is the classic stored-XSS escalation path and the main reason this merits patching despite only 'Low' individual CIA impacts. Bottom line: a genuine but not emergency vulnerability - prioritize behind any unauthenticated or actively-exploited flaws, but patch promptly on sites that allow lower-privileged contributors.

A low-privileged authenticated user (e.g. a contributor or author account on a multi-author WordPress site) uses an affected PowerPack for Elementor widget to save content containing a malicious script payload. When an administrator or other privileged user later views that content in wp-admin or on the front end, the stored script executes in their browser session, potentially stealing session cookies or performing admin actions on their behalf. No public exploit code was identified in the provided data.