CVE-2026-108478: WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Element Pack Elementor Addons (bdthemes-element-pack-lite)to a version that resolves this vulnerability.Fixed in 8.8.9
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs low-level privileges and user interaction. The issue is network-reachable and has low attack complexity.
What could successful exploitation affect?
The vulnerability is rated medium severity with low impact to confidentiality, integrity, and availability. Its scope is changed, meaning the vulnerable component can affect resources beyond its own security authority.
Which installations should be investigated?
Investigate installations of BdThemes Element Pack Elementor Addons at version 8.8.8 or earlier. The affected range is listed as through 8.8.8, with no lower bound specified.