The PowerPack Elementor Addons plugin contains an insufficiently sanitized ‘cursor_url’ parameter in all releases up to and including 2.9.4. This flaw enables an authenticated user with Contributor level or higher to store arbitrary JavaScript in the plugin’s settings. When a page that uses the custom cursor is rendered, the injected script executes for every user who views the page, allowing the attacker to modify page content or persist malicious code across visits.

Vendor ideaboxcreations provides the PowerPack Addons for Elementor – a collection of free widgets, extensions, and templates for WordPress. All releases up to and including version 2.9.4 are affected because the ‘cursor_url’ option remains unsanitized. Versions beyond 2.9.4 are not confirmed in the given data and their status is uncertain.

The flaw carries a CVSS score of 6.4 and an EPSS score of less than 1%, indicating moderate severity but a very low probability of widespread exploitation at the time of analysis. The attack requires authenticated access at Contributor level or higher, and the injected script is stored and executed automatically whenever an affected page is accessed. The vulnerability is not listed in the CISA KEV catalog.