CVE-2026-108488
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The PowerPack Addons for Elementor plugin up to version 3.1.0 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.
Risk Assessment
The risk involves potential session hijacking, data theft, or malware distribution within the WordPress site context. Both administrators and visitors may be affected.
Recommendation
It is recommended to immediately update the PowerPack Addons for Elementor plugin to the latest version that includes the fix. Also, regularly check for and apply available updates.
Other vulnerabilities in PowerPack Addons for Elementor
See all- CVE-2026-111400Medium
The PowerPack Addons for Elementor plugin contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.1.0.
- CVE-2026-114182Medium
Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PowerPack Addons for Elementor from n/a through 3.1.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS