Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
Published: 2026-10-12
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The flaw stems from improper neutralization of user input during web page generation, permitting attackers to persist malicious JavaScript code in the site’s content. A stored XSS vulnerability such as this can enable session hijacking, defacement, or redirect victims to malicious destinations, categorized as CWE‑79.

Affected Systems

The vendor BdThemes offers the Element Pack Elementor Addons plugin. All releases from the initial version through 8.8.8 are affected, meaning any installation using a version earlier than 8.8.9 is vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated administrator or editor submitting content that contains embedded scripts; the stored payload is then rendered to all visitors, allowing uncontrolled execution of client‑side code.

Generated by OpenCVE AI on October 12, 2026 at 19:32 UTC.

Remediation

Vendor Solution

Update the WordPress Element Pack Elementor Addons plugin to the latest available version (at least 8.8.9).

OpenCVE Recommended Actions

  • Update the WordPress Element Pack Elementor Addons plugin to version 8.8.9 or newer.
  • If the upgrade cannot be applied promptly, revoke the ability of non‑administrator roles to insert content via the plugin by removing the "unfiltered_html" capability from those roles or disabling the plugin’s editor features.
  • Scan existing content for injected script tags and cleanse any malicious code identified.

Generated by OpenCVE AI on October 12, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
Title WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-12T22:54:00.791Z

Reserved: 2026-10-10T00:19:05.709Z

Link: CVE-2026-108478

cve-icon Vulnrichment

Updated: 2026-10-12T22:52:43.074Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T17:17:13.237

Modified: 2026-10-13T13:28:15.717

Link: CVE-2026-108478

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T19:45:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')