EUVD-2026-20129
GHSA-7gg4-p3gv-m4fh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2. This is due to insufficient input sanitization and output escaping on SVG content fetched from remote URLs in the render_svg() function. The function fetches SVG content using wp_safe_remote_get() and then directly echoes it to the page without any sanitization, only applying a preg_replace() to add attributes to the SVG tag which does not remove malicious event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary JavaScript in SVG files that will execute whenever a user accesses a page containing the malicious widget.
AnalysisAI
Stored cross-site scripting in Element Pack Addons for Elementor plugin versions up to 8.4.2 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via malicious SVG files through the SVG Image Widget. The vulnerability exists in the render_svg() function, which fetches remote SVG content and echoes it directly to pages without proper sanitization, enabling persistent XSS attacks affecting all users who view pages containing the compromised widget. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
The vulnerability stems from improper handling of SVG content in the SVG Image Widget module of Element Pack Addons. The render_svg() function uses WordPress's wp_safe_remote_get() to retrieve SVG files from remote URLs, but outputs the fetched content directly via echo without sanitizing malicious payloads. The only processing applied-a preg_replace() operation to add attributes to SVG tags-fails to strip dangerous event handlers (such as onclick, onerror, onload) embedded within SVG elements. This represents a classic stored XSS flaw (CWE-79) where untrusted user-controlled data is stored in the WordPress database through widget configuration and later rendered unsafely in the browser context. The vulnerability is rooted in a failure to apply both input validation during SVG upload/URL configuration and output escaping during rendering, violating WordPress security best practices for content sanitization and escaping.
RemediationAI
Update Element Pack Addons for Elementor to the latest available version beyond 8.4.2, as the plugin maintainers have released patches addressing this vulnerability. Immediately audit all pages and posts using the SVG Image Widget to verify no malicious SVG content has been injected; use the WordPress plugin repository's security advisory and Wordfence threat intelligence portal (https://www.wordfence.com/threat-intel/vulnerabilities/id/0838f085-8ff7-4c6a-bd5b-af99f666377b) for patched version confirmation and detailed remediation guidance. As an interim mitigation, restrict Contributor-level permissions to trusted users only, review contributor-created widgets for suspicious SVG URLs, and consider disabling the SVG Image Widget entirely until patched. Administrators should also inspect WordPress activity logs for unauthorized widget creation or modification during the vulnerable period.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today