Element Pack Addons For Elementor
Monthly
Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.
Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.