Element Pack Elementor Addons: Stored Cross-Site Scripting
Summary
The free Lite version of the Element Pack Elementor Addons WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An authenticated user with a low-privileged account, such as Contributor, can store malicious scripts that run in the browser of other users, for example administrators, once they view the content. Successful exploitation requires a user action, and the attacker can then steal session data or take over accounts.
Affected
- Element Pack Elementor Addons (bdthemes-element-pack-lite) up to and including 10.0.3
- Pro version: Unknown.
Fixed in
- Version 10.0.4 (according to the CVE record and aggregator data; not yet confirmed in the vendor changelog).
Workaround
- Unknown. No vendor-documented workaround found.
- Restrict Contributor and higher accounts to trusted users until the update is applied.
Exploitation
- Not known to be exploited in the wild (OffSeq; Strix lists KEV: No).
- No public proof-of-concept found; search coverage is limited.
Our recommendation
- Check the installed version and update to 10.0.4 or later as soon as possible.
- Update the related CVE-2026-119501 fix (10.0.3 or later) at the same time.
- Review accounts with Contributor or higher rights and remove unneeded ones.
- Review recently submitted content from low-privileged authors, especially content viewed by administrators.
- Check whether the Pro plugin is installed and whether BdThemes has published guidance for it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry vuldb.com
- OffSeq Radar entry radar.offseq.com
- Strix CVE entry www.strix.ai
- WordPress.org plugin page wordpress.org
- Related CVE-2026-119501 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:41.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.