CVE-2026-111400: WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PowerPack Addons for Elementorto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
What access and user interaction are required to exploit this issue?
An attacker needs low-level privileges and network access, and exploitation requires a user to interact with attacker-controlled content. The impact can extend beyond the initially affected security authority.
Which installations are affected?
PowerPack Addons for Elementor versions through 3.1.0 are affected. The provided information does not identify a safe fixed version or any configuration-based exception.
What is the potential impact if exploitation succeeds?
This is a stored XSS issue with low impacts to confidentiality, integrity, and availability. Successful exploitation may allow script execution in a victim's browser in the context of the affected site.