{
 "id": "WPSEC-2026-0861",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0861/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0861/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0861/index.md",
 "title": "PowerPack Addons for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Gradient Background Colors",
 "description": "The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Gradient Background extension's color and angle settings in all versions up to, and including, 3.1.0, due to insufficient input validation and output escaping. The values were not validated and were printed unescaped in the extension's Elementor editor template and repeater title. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that will execute whenever a user, such as an administrator, opens the affected page in the Elementor editor.",
 "plugin": {
  "slug": "powerpack-lite-for-elementor",
  "name": "PowerPack Addons for Elementor",
  "full_name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
  "wordpress_org": "https://wordpress.org/plugins/powerpack-lite-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/powerpack-lite-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.1",
 "remediation": "Update to 3.1.1 or later.",
 "fix_released": "2026-10-13T00:45:59+00:00",
 "published": "2026-10-14T00:47:43+00:00",
 "updated": "2026-10-13T12:12:44.544004+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0861/",
  "https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.1/",
  "https://wordpress.org/plugins/powerpack-lite-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-13"
 }
}