CVE-2026-125708: WordPress Element Pack Elementor Addons plugin <= 10.0.4 - Cross Site Scripting (XSS) vulnerability

Q: What access and interaction are required to exploit this issue?

The CVSS vector indicates an attacker needs low-level privileges and user interaction. The attack can be performed over the network with low complexity.

Q: Which installations are affected?

Element Pack Elementor Addons versions through 10.0.4 are affected. The provided data does not state whether the vulnerable functionality is enabled in the default configuration.

Q: What is the potential impact of successful exploitation?

This is a stored XSS issue. The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bdthemes-element-pack-lite to a version that resolves this vulnerability.
Fixed in 10.0.5

Event History

Nov 11, 2026

CVE Published

via MITRE·01:01 PM

Data Sourced

via MITRE·01:01 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction are required to exploit this issue?

The CVSS vector indicates an attacker needs low-level privileges and user interaction. The attack can be performed over the network with low complexity.

Which installations are affected?

Element Pack Elementor Addons versions through 10.0.4 are affected. The provided data does not state whether the vulnerable functionality is enabled in the default configuration.

What is the potential impact of successful exploitation?