PowerPack Addons for Elementor CVE-2026-111400

Exploitation requires an authenticated WordPress account with at least contributor/editor-level access to create or modify content using PowerPack Addons for Elementor widgets (PR:L), on sites running the plugin at version 3.1.0 or earlier. The stored payload only triggers when a victim user - typically an administrator or another content viewer - subsequently loads the page containing the injected input (UI:R), so exploitation is not fully automatic and depends on a second user viewing the malicious content. Limiting factors: attacker must already have a valid low-privilege account (no anonymous/unauthenticated path), the site must have the vulnerable plugin version installed, and the impactful cross-user compromise depends on a higher-privileged user viewing the affected page.

This is a moderate, real-but-not-urgent priority rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) shows network reach and low attack complexity, but two meaningful brakes: PR:L requires the attacker to already hold an authenticated, low-privilege account (typically a contributor/author who can edit PowerPack-driven Elementor content), and UI:R means a victim (usually an administrator or site visitor) must load the poisoned page for the payload to fire. The scope change (S:C) is the aggravating factor - injected script executes in the browser of other users, including higher-privileged admins, enabling classic session/account-takeover pivots, which is why confidentiality/integrity/availability each carry Low impact. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponized exploit code; the Patchstack sourcing indicates a researcher-reported, responsibly-disclosed flaw rather than an in-the-wild campaign. Net: a legitimate stored-XSS issue worth patching in normal cycles, but the authenticated-access prerequisite plus required user interaction keep real-world risk well below that of an unauthenticated RCE. No key signals conflict, though note EPSS/KEV/POC data were simply absent from the input, not confirmed negative.

An attacker with a low-privileged authenticated account (e.g., a contributor who can build or edit Elementor content using PowerPack widgets) injects a malicious script payload into a vulnerable widget field, which is stored unsanitized. When an administrator or other user later views the affected page in the WordPress dashboard or on the front end, the script executes in their browser, potentially stealing session cookies or performing admin-level actions. No public exploit code was identified in the provided data.