CVE-2026-124752: WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vector indicates network-reachable exploitation with low attack complexity, but the attacker must have low-privilege access and must be able to induce a user interaction.

Q: What are the potential effects of successful exploitation?

This is a stored XSS issue with low confidentiality, integrity, and availability impact. The scope is changed, meaning the impact can extend beyond the vulnerable plugin's security authority.

Q: Which plugin versions are affected?

Element Pack Elementor Addons versions through 10.0.3 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bdthemes-element-pack-lite to a version that resolves this vulnerability.
Fixed in 10.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·11:46 AM

Data Sourced

via MITRE·11:46 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vector indicates network-reachable exploitation with low attack complexity, but the attacker must have low-privilege access and must be able to induce a user interaction.

What are the potential effects of successful exploitation?

This is a stored XSS issue with low confidentiality, integrity, and availability impact. The scope is changed, meaning the impact can extend beyond the vulnerable plugin's security authority.

Which plugin versions are affected?

Element Pack Elementor Addons versions through 10.0.3 are affected. The available data does not identify a fixed version.

CVE-2026-124752: WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What are the potential effects of successful exploitation?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What are the potential effects of successful exploitation?

Which plugin versions are affected?