PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Carousel Widget Image URL
- ID
- WPSEC-2026-1481
- Plugin
- PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (powerpack-lite-for-elementor)
- Affected
- all versions before 3.1.2
- Remediation
- Update to 3.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) on WPSec AttackSurface
- Fix released
- Published
Description
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the item image URL of the Info Box Carousel widget in all versions up to, and including, 3.1.1, due to insufficient output escaping of the image URL in the widget's Elementor editor template, where it is printed unescaped inside the img src attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that execute whenever a user, including an administrator, opens the affected content in the Elementor editor or its preview.
References
- https://wpsec.com/vuln/WPSEC-2026-1481/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.2/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS