# PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hotspots and Pricing Table Tooltip Size

- **ID:** WPSEC-2026-1791
- **Plugin:** PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (`powerpack-lite-for-elementor`), https://wordpress.org/plugins/powerpack-lite-for-elementor/
- **Affected versions:** all versions before 3.1.3
- **Fixed in:** 3.1.3 (Update to 3.1.3 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1791/

## Description

The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip size setting of the Image Hotspots and Pricing Table widgets in all versions up to, and including, 3.1.2, due to the value not being validated against its allowed options before the front-end script concatenates it into the tooltip's HTML class attribute. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and the tooltip is displayed.

## References

- https://wpsec.com/vuln/WPSEC-2026-1791/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.3/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1791/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.