A stored cross‑site scripting flaw was discovered in Element Pack, a WordPress addon for Elementor. The flaw is triggered by the marker_content field of the Open Street Map widget. Input is not properly sanitized or escaped, allowing an attacker to save malicious script payloads. Once a page containing the injected content is viewed, the script executes in the visitor’s browser, potentially stealing session cookies, defacing content, or performing other client‑side attacks. This weakness is classified as CWE‑79.

Versions of bdthemes’ Element Pack – Widgets, Templates & Addons for Elementor up to and including 8.1.5, both the Lite and full builds, are vulnerable. The plugin is installed on WordPress sites and can be upgraded beyond 8.1.5 to remove the flaw.

The vulnerability carries a CVSS score of 5.4, indicating moderate impact. The EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present. It is not listed in the CISA KEV catalog. Attackers must be authenticated to the WordPress admin interface with a contributor or higher role, so the prerequisite is user credentials. From there, they can enter and save malicious marker content, which is then rendered for all users who view the affected page. This inferred attack vector requires that the attacker can add or edit the Open Street Map widget—an action typically restricted to higher‑privileged contributors.