CVE-2026-105871: Element Pack Elementor Addons XSS Vulnerability

CVE-2026-105871 Overview

CVE-2026-105871 is a stored Cross-Site Scripting (XSS) vulnerability in the BdThemes Element Pack Elementor Addons plugin (bdthemes-element-pack-lite) for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All plugin versions up to and including 8.8.6 are affected. An authenticated attacker with low privileges can inject malicious scripts that persist in page content and execute in the browsers of users who view affected pages.

Critical Impact

Stored XSS enables session hijacking, credential theft, and WordPress administrator account takeover when a privileged user interacts with the injected payload.

Affected Products

• BdThemes Element Pack Elementor Addons (bdthemes-element-pack-lite)
• Versions from n/a through 8.8.6
• WordPress sites running Elementor with this plugin installed

Discovery Timeline

• 2026-10-07 - CVE-2026-105871 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105871

Vulnerability Analysis

The vulnerability resides in the Element Pack Elementor Addons plugin, which extends the Elementor page builder with additional widgets and modules. Input handled by the plugin is not properly sanitized or escaped before being rendered in generated WordPress pages. An attacker with contributor-level access or higher can inject JavaScript payloads into plugin fields. The payload is persisted in the WordPress database and executes whenever a visitor or administrator loads a page containing the compromised widget.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to apply WordPress sanitization functions such as wp_kses_post() or esc_html() to attacker-controlled widget attributes. Stored input is reflected directly into the Document Object Model (DOM), permitting script execution in the context of the WordPress site origin.

Attack Vector

Exploitation requires network access and low-privileged authentication, with a user interaction component to trigger the stored payload. A scope change indicates the injected script executes in a context broader than the attacker's. An authenticated contributor or editor crafts a widget containing a JavaScript payload, saves the Elementor page, and waits for an administrator or visitor to open it. The payload then runs with the viewer's session, enabling cookie theft, administrative action forgery, or redirection to attacker-controlled infrastructure.

Technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-105871

Indicators of Compromise

• Unexpected <script>, onerror, onload, or javascript: strings stored in Elementor post meta or wp_postmeta records associated with Element Pack widgets.
• Outbound requests from administrator browsers to unknown domains shortly after loading pages built with the plugin.
• New or modified WordPress administrator accounts created without a corresponding audit trail.

Detection Strategies

• Audit the wp_postmeta and wp_posts tables for Element Pack widget entries containing HTML event handlers or script tags.
• Review WordPress activity logs for suspicious edits by contributor or editor accounts to Elementor pages.
• Deploy Content Security Policy (CSP) reporting to capture inline script execution attempts originating from WordPress-rendered pages.

Monitoring Recommendations

• Monitor web server access logs for anomalous POST requests to admin-ajax.php and Elementor editor endpoints from low-privileged accounts.
• Alert on administrator session cookies being transmitted to external domains via browser telemetry or network inspection.
• Track plugin version inventory across WordPress deployments to confirm all instances are above 8.8.6 once a patched release is available.

How to Mitigate CVE-2026-105871

Immediate Actions Required

• Update the Element Pack Elementor Addons plugin to a version later than 8.8.6 as soon as the vendor publishes a fix.
• Review all contributor, author, and editor accounts and remove or restrict any that are not required.
• Audit existing Elementor pages for injected scripts and remove malicious content from affected widgets.

Patch Information

No patched version is identified in the available advisory data. Monitor the Patchstack Vulnerability Report and the BdThemes plugin changelog for an official security release above version 8.8.6.

Workarounds

• Deactivate the Element Pack Elementor Addons plugin until a vendor patch is released if the risk is unacceptable.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Restrict Elementor editing permissions so that only trusted administrators can create or modify pages using Element Pack widgets.
• Deploy a Web Application Firewall (WAF) rule set that filters HTML event handlers and script tags from form submissions to WordPress editor endpoints.

# Configuration example: enforce CSP via .htaccess on Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"