CVE-2026-105871
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Element Pack Elementor Addons plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.8.6.
Risk Assessment
An attacker could inject a malicious script that is stored and executed in the user's browser, potentially leading to session data theft or account takeover.
Recommendation
Update the Element Pack Elementor Addons plugin to the latest version available from the vendor that fixes this vulnerability.
Other vulnerabilities in Element Pack Elementor Addons
See all- CVE-2026-105873Medium
The Element Pack Elementor Addons plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.8.6.
- CVE-2026-66574Medium
The Element Pack Elementor Addons plugin in versions up to and including 8.8.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-65502Medium
Bypass vulnerability in Element Pack Elementor Addons versions up to 8.7.13 allows an unauthenticated attacker to bypass security controls.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS