CVE-2026-111400
MediumCVSS 6.5Summary
The PowerPack Addons for Elementor plugin contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.1.0.
Risk Assessment
An attacker can inject a malicious script that is stored and executed in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update the PowerPack Addons for Elementor plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in PowerPack Addons for Elementor
See all- CVE-2026-114182Medium
Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PowerPack Addons for Elementor from n/a through 3.1.0.
- CVE-2026-108488Medium
The PowerPack Addons for Elementor plugin up to version 3.1.0 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS