CVE-2026-105871 in Element Pack Elementor Addons Plugin
Summary
by MITRE • 10/07/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the BdThemes Element Pack plugin for WordPress, affecting versions from n/a through 8.8.6. Unlike reflected XSS attacks where malicious scripts are executed via manipulated URLs, stored vulnerabilities persist on the target server because user-supplied input is saved in a database or other storage mechanism and subsequently rendered to users without proper sanitization. In this context, an attacker can inject executable JavaScript code into fields that are processed by the Element Pack add-ons, such as widget settings, form inputs, or content areas managed through the WordPress admin interface. Once stored, this malicious payload is served to every visitor who views the affected page, turning a single injection point into a widespread attack vector.
From a technical perspective, the root cause lies in the insufficient validation and encoding of user input before it is outputted by the plugin's rendering engine. The application fails to apply appropriate context-specific escaping rules when generating HTML content for Elementor pages. This allows special characters that define script boundaries or event handlers to pass through unaltered. When a victim with administrative privileges, such as an editor or administrator, interacts with the vulnerable component and saves their input, the malicious code becomes part of the page's permanent structure. Subsequently, when any user accesses this content via a web browser, the browser interprets the injected script as legitimate code belonging to the site, thereby executing it within the security context of that domain. This bypasses same-origin policy protections because the script is served from the trusted origin itself.
The operational impact of this vulnerability is severe due to its stored nature and the typical privilege levels required to exploit it effectively in WordPress environments. An attacker who gains access to an account with sufficient permissions can embed persistent malicious scripts that execute automatically for all site visitors. This capability enables a range of hostile actions, including session hijacking where attackers steal authentication cookies to impersonate legitimate users, credential harvesting through fake login forms injected into the page content, and defacement of the website's visual presentation. Furthermore, stored XSS is frequently leveraged as an initial access vector in broader attack chains, allowing adversaries to pivot from a simple script execution to more sophisticated exploits such as keylogging or redirecting traffic to phishing sites designed to compromise end-user systems.
In terms of industry standard classifications, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The specific behavior of storing the payload for later execution maps directly to ATT&CK technique T1059.007, which covers JavaScript under Command and Control or Execution categories depending on the final objective. Additionally, if the attacker uses this access to further compromise other users' sessions, it relates to CWE-64: Improper Neutralization of Script-Related HTML Tags in a Web Page, although the primary classification remains XSS due to the execution context. The persistence of the payload distinguishes it from transient attacks and increases the difficulty of detection without active monitoring or input validation logs.
Mitigation strategies must focus on both immediate remediation and long-term defensive posture improvements. The most critical step is for administrators to update the BdThemes Element Pack plugin to a version newer than 8.8.6, where this specific input handling flaw has been addressed by the vendor through enhanced sanitization routines. For environments where updating is not immediately feasible, implementing Web Application Firewall rules that detect and block common XSS payloads in POST requests targeting WordPress admin endpoints can provide temporary relief. Additionally, enforcing strict Content Security Policy headers on the website can significantly reduce the impact of successful exploitation by restricting the sources from which scripts are allowed to execute. Regular security audits focusing on input validation practices within custom plugins and third-party add-ons are essential to prevent similar vulnerabilities in the future, ensuring that all user-supplied data is rigorously validated against expected formats before being processed or stored.