The Element Pack Addons for Elementor plugin for WordPress contains a stored XSS vulnerability caused by insufficient input sanitization and output escaping when the 'marker_content’ parameter is used. This flaw allows an authenticated contributor to inject arbitrary JavaScript that will execute in any user’s browser whenever an injected page is viewed, compromising confidentiality, integrity, and availability of the site’s front‑end. The flaw is a classic example of CWE‑79: Improper Neutralization of Input During Web Page Generation.

bdthemes Element Pack – Widgets, Templates & Addons for Elementor plugin for WordPress. All releases up to and including version 5.11.2 are affected. Any WordPress site running these versions is vulnerable.

With a CVSS base score of 6.4, the vulnerability is considered moderate. The EPSS score is below 1%, indicating that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. Attackers must first possess Contributor or higher-level access, so the attack vector is authenticated. Once authenticated, an attacker can embed malicious scripts that execute in users’ browsers when they visit the crafted content, potentially allowing credential theft, defacement, or further lateral movement.