The plugin’s SVG Image Widget fetches external SVG files and echoes their content directly. Because it only adds attributes and does not strip malicious event handlers, a Contributor‑level user can upload or reference a crafted SVG containing JavaScript. When any visitor views the page with the widget, the script runs in that visitor’s browser, giving the attacker the ability to steal session cookies, deface content, or execute further attacks within the site context.

WordPress sites running bdthemes Element Pack – Widgets, Templates & Addons for Elementor version 8.4.2 or earlier are vulnerable. The issue exists in the SVG Image Widget module and affects all deployments that provide Contributor or higher role access.

The CVSS base score of 6.4 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires possession of Contributor or higher privileges to inject the malicious SVG, but the impact is achieved on any user who views the affected page, meaning it can affect all authenticated or anonymous visitors depending on the widget’s placement.