# PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Carousel Widget Image URL

- **ID:** WPSEC-2026-1481
- **Plugin:** PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (`powerpack-lite-for-elementor`), https://wordpress.org/plugins/powerpack-lite-for-elementor/
- **Affected versions:** all versions before 3.1.2
- **Fixed in:** 3.1.2 (Update to 3.1.2 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1481/

## Description

The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the item image URL of the Info Box Carousel widget in all versions up to, and including, 3.1.1, due to insufficient output escaping of the image URL in the widget's Elementor editor template, where it is printed unescaped inside the img src attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that execute whenever a user, including an administrator, opens the affected content in the Elementor editor or its preview.

## References

- https://wpsec.com/vuln/WPSEC-2026-1481/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.2/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1481/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.