PowerPack Addons for Elementor: Sensitive data exposure in WordPress plugin
Summary
The WordPress plugin PowerPack Addons for Elementor up to and including version 3.1.3 inserts sensitive information into data it sends, which allows retrieval of embedded sensitive data. The CVSS 3.1 base score is 5.3 (medium) with a vector of network access, no privileges and no user interaction, and only a low confidentiality impact. The type of data exposed is not specified in the sources. Any unauthenticated visitor of a public WordPress site running the affected plugin could be able to obtain this data.
Affected
- PowerPack Addons for Elementor (WordPress plugin, slug powerpack-lite-for-elementor) from n/a through 3.1.3
Fixed in
- Version 3.1.4 or later (per CNA Patchstack; vendor advisory not found)
Workaround
- Unknown. No workaround is documented in the sources. Updating is the named remedy.
Exploitation
- Not known to be exploited according to OffSeq. CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept and no CISA KEV listing found at time of research.
Our recommendation
- Check the installed PowerPack Addons for Elementor version on every WordPress site and update to 3.1.4 or later.
- Identify which data the sites hold that would matter if leaked, such as form submissions, customer data or admin-only content.
- Watch the Patchstack advisory for details on the exposed data type and for any proof of concept.
- Track the plugin's patch cadence, as several other 2026 vulnerabilities were fixed in 3.1.3.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125435 www.cve.org
- Patchstack advisory patchstack.com
- OffSeq threat radar entry radar.offseq.com
- WPScan plugin page wpscan.com
- WPSec plugin vulnerabilities wpsec.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:43.
Original description (NVD)
Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.