CVE-2026-105873: Element Pack Elementor Addons XSS Flaw

CVE-2026-105873 Overview

CVE-2026-105873 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the BdThemes Element Pack Elementor Addons plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation. Attackers with low-privileged authenticated access can inject malicious scripts that persist in the application and execute in the browsers of other users, including administrators. The vulnerability affects all versions of bdthemes-element-pack-lite from an unspecified initial release through version 8.8.6. Successful exploitation requires user interaction and can lead to session hijacking, credential theft, or administrative account compromise within affected WordPress environments.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site administrators, enabling account takeover and lateral movement within WordPress deployments.

Affected Products

BdThemes Element Pack Elementor Addons (bdthemes-element-pack-lite)
All versions from initial release through 8.8.6
WordPress sites running Elementor with the affected plugin installed

Discovery Timeline

2026-10-07 - CVE CVE-2026-105873 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105873

Vulnerability Analysis

The vulnerability is a stored XSS condition in the Element Pack Elementor Addons plugin. Stored XSS occurs when an application accepts untrusted input, persists it to a data store, and later renders it in a response without proper encoding or sanitization. In this case, input provided through plugin-controlled widgets or settings is written to the WordPress database and reflected into rendered pages. Because the payload persists, every subsequent visitor who loads the affected page triggers the injected script. The attack takes place over the network and requires low-privileged authentication combined with user interaction, with a scope change that extends the impact beyond the vulnerable component.

Root Cause

The root cause is insufficient input validation and output escaping within the plugin's widget rendering logic. WordPress provides sanitization helpers such as wp_kses_post(), esc_html(), and esc_attr() that must be applied at the appropriate output context. Missing or incorrect use of these functions allows raw HTML and JavaScript to flow from stored content to the DOM.

Attack Vector

An authenticated attacker with contributor-level or higher privileges submits crafted input through an Element Pack widget field. The plugin stores the payload without stripping script-capable content. When an administrator or other user renders the affected page, the browser executes the injected JavaScript in the context of the WordPress origin. This enables cookie theft, forced actions through the WordPress REST API, or injection of additional backdoors. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-105873

Indicators of Compromise

Unexpected <script> tags, onerror=, or onload= attributes embedded within WordPress post content, widget options, or wp_postmeta entries tied to Element Pack widgets.
Outbound HTTP requests from administrator browser sessions to unfamiliar domains shortly after loading pages built with Element Pack.
Creation of new administrator accounts or modified user roles without a corresponding legitimate workflow entry.

Detection Strategies

Query the WordPress database for suspicious markup within Element Pack widget data, focusing on tags and event handlers that bypass expected formatting.
Deploy a web application firewall rule that inspects authenticated POST requests to admin-ajax.php and the Elementor editor endpoints for script-capable payloads.
Review web server access logs for repeated edits by low-privileged accounts followed by administrator page views.

Monitoring Recommendations

Monitor WordPress audit logs for post and widget modifications by contributor or author accounts.
Alert on administrator sessions that generate unexpected REST API calls, particularly to /wp-json/wp/v2/users with POST or PUT methods.
Track plugin version inventory across managed WordPress sites to confirm patch status for bdthemes-element-pack-lite.

How to Mitigate CVE-2026-105873

Immediate Actions Required

Update the Element Pack Elementor Addons plugin to a version later than 8.8.6 as soon as the vendor publishes a patched release.
Audit existing posts, pages, and widget configurations for injected script content and remove any unauthorized payloads.
Rotate administrator credentials and invalidate active sessions if the plugin was exposed to untrusted contributors.

Patch Information

At the time of publication, the vulnerability affects all versions through 8.8.6. Review the Patchstack Vulnerability Report for the latest fixed version and vendor remediation guidance.

Workarounds

Restrict contributor, author, and editor accounts to trusted users until a patched release is deployed.
Deploy a Content Security Policy (CSP) that disallows inline scripts to limit the impact of successful XSS injection.
Temporarily disable the Element Pack plugin on sites that permit untrusted content submission.

bash

# Configuration example: enumerate installed plugin version via WP-CLI
wp plugin get bdthemes-element-pack-lite --field=version
wp plugin update bdthemes-element-pack-lite