Live › vulnerability › CVE-2026-111400
Go to dashboardPowerPack Addons for Elementor, a WordPress plugin, has a stored cross-site scripting flaw in versions through 3.1.0. An attacker can plant script that runs in the browser of anyone who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running PowerPack Addons for Elementor at version 3.1.0 or earlier are exposed. Exploitation needs a way to store input that is later rendered to visitors, so sites where only trusted editors can write content carry less risk. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get powerpack-lite-for-elementor --field=versionpowerpack-lite-for-elementorpowerpack-lite-for-elementor) to a version later than 3.1.0; the sources do not name the fixed version, so check the plugin's changelogEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111400")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.