What is the CVSS score of CVE-2026-32430?

CVE-2026-32430 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Powerpack Addons For Elementor are affected by CVE-2026-32430?

CVE-2026-32430 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2026-32430?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Powerpack Addons For Elementor CVE-2026-32430

EUVD-2026-11964 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 Patchstack

XSS Powerpack Addons For Elementor Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11964

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in PowerPack Addons for Elementor (powerpack-lite-for-elementor) versions up to 2.9.9, allowing authenticated attackers with limited privileges to inject malicious scripts that persist in the application and execute in other users' browsers. While the CVSS score is moderate (6.5) and EPSS exploitation probability is low (0.03%, percentile 8%), the vulnerability requires user interaction (UI:R) and authenticated access (PR:L), reducing real-world exploitability. No evidence of active exploitation (KEV status) or public proof-of-concept has been identified at this time.

Technical ContextAI

The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in PowerPack Addons for Elementor, a WordPress plugin (CPE: cpe:2.3:a:ideabox_creations:powerpack_addons_for_elementor) that extends Elementor page builder functionality. Stored XSS occurs when user-controlled input is inadequately sanitized before being persisted in the database and subsequently rendered in web pages without proper output encoding. In this context, the vulnerability likely exists in one or more Elementor addon widgets where user-supplied content (text fields, custom attributes, or configuration parameters) is stored without sanitization and rendered without escaping, allowing attackers to inject JavaScript that executes in the context of the WordPress admin panel or frontend when other users view the affected content.

RemediationAI

Immediate Actions: (1) Update PowerPack Addons for Elementor to version 2.10.0 or later (patch version not explicitly stated in provided data but standard versioning suggests 2.10.0+ contains the fix); (2) If automatic updates are not enabled, manually update via WordPress Admin > Plugins > Updates or through the plugin repository. Verification: After patching, audit any pages/posts created with affected PowerPack widgets to ensure no malicious scripts were injected during the vulnerable window. Workarounds (if patching is delayed): (1) Disable or deactivate PowerPack Addons for Elementor if not actively used; (2) Restrict plugin access by limiting which user roles can edit pages with PowerPack widgets (WordPress User Role Editor); (3) Implement Content Security Policy (CSP) headers to mitigate reflected/stored XSS impact; (4) Monitor admin activity logs for suspicious content creation. Patch Source: Patchstack database entry recommends checking the official PowerPack Addons for Elementor repository on wordpress.org or the vendor's website at ideaboxcreations.com for patch availability and release notes.