{"id":"CVE-2026-125435","kind":"vulnerability","aliases":["CVE-2026-125435"],"related":[],"title":"PowerPack Addons for Elementor: sensitive data embedded in sent responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.","summary":"PowerPack Addons for Elementor, a WordPress plugin, inserts sensitive information into data it sends to visitors. An attacker can retrieve that embedded sensitive data from the responses.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"powerpack-lite-for-elementor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","package","powerpack-lite-for-elementor","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed version of the PowerPack Addons for Elementor plugin (powerpack-lite-for-elementor) in the WordPress admin under Plugins.","fix":"- PowerPack Addons for Elementor through `3.1.3`: the sources do not state a fixed version.","status":"open","published_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:37+00:00","updated_at":"2026-11-11T13:29:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:37Z","model":"claude-haiku-5-5","output":{"fix":"- PowerPack Addons for Elementor through `3.1.3`: the sources do not state a fixed version.\n- unknown","reach":"internet","title":"PowerPack Addons for Elementor: sensitive data embedded in sent responses","impact":"medium","summary":"PowerPack Addons for Elementor, a WordPress plugin, inserts sensitive information into data it sends to visitors. An attacker can retrieve that embedded sensitive data from the responses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","powerpack-lite-for-elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive data embedded in site responses","analyst_note":"Find the fixed version and the exact sensitive data exposed, from the vendor advisory or the Wordfence/WPScan record for CVE-2026-125435.","how_to_check":"- Check the installed version of the PowerPack Addons for Elementor plugin (powerpack-lite-for-elementor) in the WordPress admin under Plugins.\n- unknown","plain_action":"","product_name":"powerpack-lite-for-elementor","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running PowerPack Addons for Elementor (powerpack-lite-for-elementor) version 3.1.3 or earlier are in the affected range according to NVD. The sources do not describe the exact configuration or data path that exposes the embedded data, so unknown whether all installations are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4574,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125435':13A,16A '-2026':12A,15A '3.1.3':91C 'addon':2A,31B,69C,85C 'affect':83C 'allow':77C 'attack':47B 'creation':67C 'cve':11A,14A 'data':6A,41B,53B,63C 'data.this':81C 'elementor':4A,21A,22B,28B,33B,71C,76C,87C 'embed':7A,51B,79C 'for':20A 'ideabox':66C 'inform':39B,60C 'insert':37B,57C 'issu':82C 'lite':19A,26B,74C 'n/a':89C 'packag':23B 'plugin':36B 'powerpack':1A,18A,25B,30B,68C,73C,84C 'powerpack-lite-for-elementor':17A,24B,72C 'respons':10A,56B 'retriev':49B,78C 'send':43B 'sensit':5A,38B,52B,59C,80C 'sent':9A,62C 'visitor':45B 'vulner':64C 'wordpress':29B,35B","nicknames":[],"mitigations":[],"who_affected":"Sites running PowerPack Addons for Elementor (powerpack-lite-for-elementor) version 3.1.3 or earlier are in the affected range according to NVD. The sources do not describe the exact configuration or data path that exposes the embedded data, so unknown whether all installations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["powerpackliteforelementor"],"ptokens":["elementor","for","lite","powerpack"],"labels":["elementor","medium","package","powerpackliteforelementor","vendor","wordpress"],"campaign_type":null,"search_a":"'-125435':13A,16A '-2026':12A,15A 'addon':2A 'cve':11A,14A 'data':6A 'elementor':4A,21A 'embed':7A 'for':20A 'lite':19A 'powerpack':1A,18A 'powerpack-lite-for-elementor':17A 'respons':10A 'sensit':5A 'sent':9A","search_b":"'addon':31B 'attack':47B 'data':41B,53B 'elementor':22B,28B,33B 'embed':51B 'inform':39B 'insert':37B 'lite':26B 'packag':23B 'plugin':36B 'powerpack':25B,30B 'powerpack-lite-for-elementor':24B 'respons':56B 'retriev':49B 'send':43B 'sensit':38B,52B 'visitor':45B 'wordpress':29B,35B","search_c":"'3.1.3':91C 'addon':69C,85C 'affect':83C 'allow':77C 'creation':67C 'data':63C 'data.this':81C 'elementor':71C,76C,87C 'embed':79C 'ideabox':66C 'inform':60C 'insert':57C 'issu':82C 'lite':74C 'n/a':89C 'powerpack':68C,73C,84C 'powerpack-lite-for-elementor':72C 'retriev':78C 'sensit':59C,80C 'sent':62C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125435","severity":null,"published_at":"2026-11-11T13:17:20+00:00","modified_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}