{"id":"CVE-2026-124752","kind":"vulnerability","aliases":["CVE-2026-124752"],"related":[],"title":"Element Pack Elementor Addons: stored XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.","summary":"Element Pack Elementor Addons, a WordPress plugin for Elementor, has a stored cross-site scripting flaw in versions through 10.0.3. An attacker can save script code that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bdthemes-element-pack-lite","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bdthemes-element-pack-lite","elementor","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `bdthemes-element-pack-lite` plugin in the WordPress admin under Plugins.\n- Compare it against `10.0.3`; versions up to and including `10.0.3` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-11T12:19:48+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:28:34+00:00","updated_at":"2026-11-11T12:28:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T12:28:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Element Pack Elementor Addons: stored XSS lets attackers run scripts in pages","impact":"medium","summary":"Element Pack Elementor Addons, a WordPress plugin for Elementor, has a stored cross-site scripting flaw in versions through 10.0.3. An attacker can save script code that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","bdthemes-element-pack-lite"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, stealing sessions or altering pages.","analyst_note":"Confirm the fixed version and required privilege from the NVD entry or the plugin vendor's changelog.","how_to_check":"- Check the installed version of the `bdthemes-element-pack-lite` plugin in the WordPress admin under Plugins.\n- Compare it against `10.0.3`; versions up to and including `10.0.3` are listed as affected.","plain_action":"","product_name":"bdthemes-element-pack-lite","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Element Pack Elementor Addons plugin (bdthemes-element-pack-lite) with a version listed as affected. Sites without the plugin are not exposed. The sources do not say which user roles can store the malicious input.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4565,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124752':15A,18A '-2026':14A,17A '10.0.3':52B,101C 'addon':4A,35B,83C,97C 'affect':93C 'allow':89C 'attack':8A,54B 'bdtheme':25B,79C,85C 'bdthemes':20A 'bdthemes-element-pack-lit':24B,84C 'bdthemes-element-pack-lite':19A 'browser':64B 'code':58B 'cross':45B,74C 'cross-sit':44B,73C 'cve':13A,16A 'element':1A,21A,26B,32B,80C,86C,94C 'elementor':3A,29B,34B,40B,82C,96C 'flaw':48B 'generat':72C 'improp':65C 'input':68C 'issu':92C 'let':7A 'lite':23A,28B,88C 'n/a':99C 'neutral':66C 'pack':2A,22A,27B,33B,81C,87C,95C 'packag':30B 'page':12A,71C 'plugin':38B 'run':9A,60B 'save':56B 'script':10A,47B,57B,76C 'site':46B,75C 'store':5A,43B,90C 'version':50B 'visitor':63B 'vulner':77C 'web':70C 'wordpress':31B,37B 'xss':6A 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Element Pack Elementor Addons plugin (bdthemes-element-pack-lite) with a version listed as affected. Sites without the plugin are not exposed. The sources do not say which user roles can store the malicious input.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bdthemeselementpacklite"],"ptokens":["bdthemes","element","lite","pack"],"labels":["bdthemeselementpacklite","elementor","medium","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-124752':15A,18A '-2026':14A,17A 'addon':4A 'attack':8A 'bdthemes':20A 'bdthemes-element-pack-lite':19A 'cve':13A,16A 'element':1A,21A 'elementor':3A 'let':7A 'lite':23A 'pack':2A,22A 'page':12A 'run':9A 'script':10A 'store':5A 'xss':6A","search_b":"'10.0.3':52B 'addon':35B 'attack':54B 'bdtheme':25B 'bdthemes-element-pack-lit':24B 'browser':64B 'code':58B 'cross':45B 'cross-sit':44B 'element':26B,32B 'elementor':29B,34B,40B 'flaw':48B 'lite':28B 'pack':27B,33B 'packag':30B 'plugin':38B 'run':60B 'save':56B 'script':47B,57B 'site':46B 'store':43B 'version':50B 'visitor':63B 'wordpress':31B,37B","search_c":"'10.0.3':101C 'addon':83C,97C 'affect':93C 'allow':89C 'bdtheme':79C,85C 'bdthemes-element-pack-lit':84C 'cross':74C 'cross-sit':73C 'element':80C,86C,94C 'elementor':82C,96C 'generat':72C 'improp':65C 'input':68C 'issu':92C 'lite':88C 'n/a':99C 'neutral':66C 'pack':81C,87C,95C 'page':71C 'script':76C 'site':75C 'store':90C 'vulner':77C 'web':70C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124752","severity":null,"published_at":"2026-11-11T12:19:48+00:00","modified_at":"2026-11-11T12:19:48+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}