Element Pack CVE-2026-66574

Requires an authenticated WordPress Contributor-level (or higher) account on a site running BDThemes Element Pack Elementor Addons <= 8.8.3, plus victim interaction: a higher-privileged user (editor/administrator) must subsequently view the attacker-supplied content for the injected script to execute (UI:R). Exploitation is therefore limited by the need for a valid low-privileged account and a triggering victim view; it does not work against fully unauthenticated visitors and is not a default-config remote-code path.

This is a moderate-severity authenticated stored/reflected XSS, not an urgent priority. The vendor (Patchstack) CVSS 3.1 6.5 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L is internally consistent with a Contributor-level XSS: network-reachable and low-complexity, but gated behind PR:L (a valid Contributor account) and UI:R (a victim, typically an editor/admin, must view the injected content). The scope change (S:C) and low C/I/A reflect script execution crossing from the plugin's rendering context into the victim's browser session. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is a malicious or compromised low-privileged contributor escalating toward an admin session rather than mass remote compromise - a manageable patch-cycle item, not an emergency. Note the input carries no fix version, so remediation timing cannot be confirmed from the data.

An attacker who holds (or has phished/registered) a WordPress Contributor account on a site running BDThemes Element Pack <= 8.8.3 saves a post or Elementor widget containing a crafted XSS payload in a field that the plugin fails to sanitize/escape. When an administrator or editor later previews or opens that content in wp-admin, the script executes in their authenticated browser session, enabling session/cookie theft or admin actions. No public exploit code is identified in the provided data.