CVE-2026-105873 in Element Pack Plugin
Summary
by MITRE • 10/07/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the BdThemes Element Pack plugin for WordPress, affecting versions from n/a through 8.8.6. Unlike reflected XSS where malicious scripts are executed via manipulated URLs, stored XSS involves the persistence of malicious input on the target server. In this context, an attacker can inject executable JavaScript code into fields or inputs that are subsequently saved to the database and rendered in web pages without proper sanitization. This means the payload is not merely passed through but is permanently embedded within the application's content, ensuring it executes for every user who views the affected page.
The technical root cause lies in the insufficient validation and escaping of user-supplied data before it is processed by the server-side logic or rendered to the client browser. When a user submits input containing script tags or event handlers, the plugin fails to neutralize these characters effectively. Consequently, when an administrator or any other authenticated user accesses the compromised page, their browser interprets the stored content as executable code rather than plain text. This execution occurs within the security context of the website, granting the injected scripts full access to cookies, session tokens, and local storage associated with that domain. The vulnerability is particularly severe because it does not require social engineering tricks like phishing links; instead, the malicious payload waits passively on the server until a victim visits the page.
The operational impact of this Stored XSS vulnerability is significant for both site administrators and end-users. For attackers, successful exploitation allows for session hijacking, where they can steal authentication cookies to impersonate legitimate users, potentially gaining administrative control over the WordPress installation. This level of access enables further compromise such as defacement, malware distribution, or data exfiltration from the database. Furthermore, if the site serves content to a broader audience, attackers can deploy keyloggers, redirect traffic to malicious sites, or phish sensitive information directly through pop-ups generated by the injected scripts. The persistence of the attack vector means that even after the initial injection is discovered and removed, any cached pages served before remediation may still expose users to the threat until caches are cleared.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It also maps closely to MITRE ATT&CK technique T1059.007, which covers JavaScript execution on the client side. The stored nature of the exploit corresponds to persistence mechanisms where malicious code is embedded in legitimate data streams. To mitigate this risk, developers must implement strict input validation and output encoding strategies. All user inputs should be sanitized against a whitelist of allowed characters rather than relying solely on blacklist approaches. Additionally, implementing Content Security Policy headers can help restrict the execution of inline scripts, providing an additional layer of defense even if sanitization fails. For users running affected versions, immediate updating to version 8.8.7 or later is critical to patch this vulnerability and secure the integrity of the web application environment.