Element Pack Elementor Addons: Stored Cross-Site Scripting
Summary
The WordPress plugin Element Pack Elementor Addons (bdthemes-element-pack-lite) up to version 10.0.4 contains a stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with low privileges, such as a contributor, can store malicious script code that runs in the browser of another user who views the page. Successful exploitation requires a privileged user, such as an administrator or editor, to interact with the crafted content, and the scope is changed, so the impact can extend to the administrator's session.
Affected
- Element Pack Elementor Addons (bdthemes-element-pack-lite), WordPress plugin, versions from n/a through 10.0.4
- Prerequisite: contributor-level or higher account (PR:L), user interaction required (UI:R)
Fixed in
- Vendor fix for this CVE: Unknown. The CVE record and Patchstack list 10.0.5 as patched; the vendor changelog for 10.0.4 mentions a separate stored XSS fix, and it is not confirmed whether it covers CVE-2026-125708.
- Update to at least 10.0.5 as recommended by Patchstack.
Workaround
- Until a fixed version is confirmed, treat all installations as potentially vulnerable.
- Limit contributor and editor accounts to trusted staff.
- Review recently edited Elementor pages and widget settings, including custom attributes, for injected scripts.
- Consider a web application firewall or virtual patch if the vendor fix is unclear.
Exploitation
- Known exploitation in the wild: Nothing found.
- Public proof of concept: Nothing found for this CVE.
- CISA KEV: Not listed.
- An older, separate issue in this plugin (CVE-2024-10980) has a public proof of concept, which shows the impact such flaws can have.
Our recommendation
- Update the plugin to version 10.0.5 or later and verify the Patchstack entry for the current fixed version.
- Restrict contributor and editor accounts, and disable untrusted user registration.
- Review recently edited content and widget settings for injected scripts.
- Monitor for new advisories for this plugin, as several stored XSS issues were published in 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WordPress.org plugin page (changelog) en-gb.wordpress.org
- Strix CVE mirror www.strix.ai
- Sibling CVE-2026-124752 (Strix) www.strix.ai
- Sibling CVE-2026-124752 (OffSeq) radar.offseq.com
- CVE-2024-10980 (CleanTalk research) research.cleantalk.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:24.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.