CVE-2026-119501: WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

Q: Which versions are affected?

Element Pack Elementor Addons versions through 10.0.2 are affected. The available data does not identify a fixed version.

Q: What type of impact can this issue have?

This is a stored cross-site scripting vulnerability. Malicious input can be stored and later rendered in a web page without proper neutralization.

Published Nov 7, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bdthemes-element-pack-lite to a version that resolves this vulnerability.
Fixed in 10.0.3

Event History

Nov 7, 2026

CVE Published

via MITRE·10:16 AM

Data Sourced

via MITRE·10:16 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which versions are affected?

Element Pack Elementor Addons versions through 10.0.2 are affected. The available data does not identify a fixed version.

What type of impact can this issue have?

This is a stored cross-site scripting vulnerability. Malicious input can be stored and later rendered in a web page without proper neutralization.