CVE-2026-108488: WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Q: Can an unauthenticated visitor exploit this issue?

The CVSS vector indicates that low privileges are required, so unauthenticated exploitation is not indicated. The specific account role or permission needed is not provided.

Q: Does exploitation require user interaction?

Yes. The CVSS vector marks user interaction as required, meaning an attacker must cause another user to interact with the stored malicious content.

Q: What is the expected impact if exploitation succeeds?

The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

Published Oct 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.

Affected Software

1 affected component

IdeaBox Creations PowerPack Addons for Elementor<=3.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade powerpack-lite-for-elementor to a version that resolves this vulnerability.
Fixed in 3.1.1

Event History

Oct 13, 2026

CVE Published

via MITRE·08:38 AM

Data Sourced

via MITRE·08:38 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Can an unauthenticated visitor exploit this issue?

The CVSS vector indicates that low privileges are required, so unauthenticated exploitation is not indicated. The specific account role or permission needed is not provided.

Does exploitation require user interaction?