EUVD-2026-51941
GHSA-mpqf-3vc4-r52m
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is PR:L not PR:H; stored XSS executing in victim browsers warrants S:C; no availability impact on the application itself.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.
AnalysisAI
Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.
Technical ContextAI
Element Pack Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets. The vulnerability arises because option values supplied by authenticated users are embedded into HTML data attributes without server-side sanitization. A bundled front-end JavaScript library then re-parses these data attributes during page rendering in the visitor's browser, treating unescaped values as executable content - a classic DOM-augmented stored XSS pattern classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The malicious payload persists in the WordPress database as part of page or post content and executes on every subsequent page load. All versions under CPE cpe:2.3:a:unknown:element_pack_addons_for_elementor:*:*:*:*:*:*:*:* from 0 up to (not including) 8.7.13 are confirmed affected per EUVD-2026-51941.
RemediationAI
Upgrade Element Pack Addons for Elementor to version 8.7.13 or later immediately via the WordPress admin dashboard (Plugins > Updates) or via WP-CLI using 'wp plugin update element-pack'. This is a vendor-confirmed patch and represents the primary remediation. If an immediate upgrade is operationally blocked, restrict new contributor-level user registrations and audit all existing contributor accounts for untrusted parties, since the attack requires at minimum contributor access to inject a payload. Deploying a strict Content Security Policy (CSP) header that prohibits inline script execution ('script-src' without 'unsafe-inline') is an effective compensating control that significantly limits XSS impact, though it may break other JavaScript-dependent plugin functionality and requires testing. Web Application Firewall rules targeting data attribute injection patterns can also reduce risk as an interim measure. Advisory reference: https://wpscan.com/vulnerability/b2554df8-3083-41cf-8f62-04568ab3a9de/
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today