POWERPACK-LITE-FOR-ELEMENTOR · CVE-2026-125435 · Package
NO FIX YET · SEE WHAT TO DO
PowerPack Addons for Elementor, a WordPress plugin, inserts sensitive information into data it sends to visitors. An attacker can retrieve that embedded sensitive data from the responses.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running PowerPack Addons for Elementor (powerpack-lite-for-elementor) version 3.1.3 or earlier are in the affected range according to NVD. The sources do not describe the exact configuration or data path that exposes the embedded data, so unknown whether all installations are affected.
Who cares elementor, powerpack-lite-for-elementor, wordpress
3.1.3: the sources do not state a fixed version.Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.