Element Pack EUVD-2026-94249

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of creating or editing content through Element Pack's Elementor widgets, and it requires a second user (UI:R) - typically an administrator or editor - to subsequently view the page containing the stored payload. The flaw is reachable over the network against the plugin's content-authoring surface, but it is NOT exploitable by fully unauthenticated attackers and will not fire without a victim rendering the malicious content. Limiting factors: the need for a pre-existing contributor/author-or-higher account sharply reduces exposure on single-admin sites, making multi-author installations (membership, editorial, or client-managed WordPress deployments) the realistic risk population.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but privilege-and-interaction-gated flaw: PR:L means the attacker must already hold an authenticated, low-privilege WordPress account (typically contributor/author able to use Elementor widgets), and UI:R means a victim (e.g., an administrator or other user) must render the poisoned content for the payload to fire. The scope change (S:C) is the one aggravating signal - the injected script executes in the victim's browser session rather than the plugin's own context, enabling session/credential theft or admin-action abuse, which is why impacts are rated Low across C/I/A rather than None. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (authenticated stored XSS with user interaction), so there are no contradictions to flag - but note the input supplied no EPSS probability, meaning likelihood of widespread exploitation cannot be quantified from the data given. Overall: a real but second-tier issue, most dangerous on multi-author WordPress sites where lower-trust contributor accounts exist.

An attacker with a low-privilege authenticated account (e.g., contributor or author) on a WordPress site running Element Pack crafts a page or widget containing a malicious script payload that the plugin stores without proper neutralization. When a higher-privileged user, such as an administrator reviewing or editing the content, loads the affected page in the WordPress dashboard or front end, the stored script executes in their browser session. No public exploit code was identified at time of analysis, but exploitation is straightforward given low attack complexity (AC:L).