The PowerPack Elementor Addons plugin is vulnerable to stored cross-site scripting through the Custom Cursor Extension. A user with Contributor role or higher can inject malicious scripts into a page’s content, and those scripts execute for any visitor who opens that page. This flaw arises from insufficient sanitization of input and lack of output escaping, allowing arbitrary code to run in the victim’s browser.

The vulnerability affects PowerPack Addons for Elementor by ideaboxcreations, versions up to and including 2.9.0. All installations of the free widgets, extensions and templates plugin that have not yet been upgraded to a newer release are potentially exposed.

The CVSS base score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Since an attacker must first obtain contributor‑level access, the risk is bounded by how many users have that privilege; however, any injected script will run for every site visitor that loads the affected page.