The Element Pack plugin for Elementor is vulnerable to stored cross‑site scripting through its Wrapper Link, Countdown, and Gallery widgets. Attackers with Contributor or higher permissions can inject arbitrary JavaScript into these widgets, which is then served to any user who views the affected page. This flaw permits attackers to execute code in the victim’s browser, potentially allowing data theft, session hijacking, or defacement.

The flaw exists in all releases of the Element Pack – Widgets, Templates & Addons for Elementor plugin up to version 5.10.28. WordPress sites running any of these versions, including the Lite edition, are susceptible as long as users with Contributor‑level access can configure the vulnerable widgets.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1 % suggests that public exploitation is presently uncommon, and the vulnerability is not listed in the CISA KEV catalog. However, because it requires authenticated Contributor‑level access, an attacker must first compromise or legitimately access a WordPress site and then inject malicious content via the vulnerable widgets.