CVE-2026-105871: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in BdThemes Element Pack Elementor Addons

This vulnerability in BdThemes Element Pack Elementor Addons (up to version 8.8.6) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with at least low privileges and requiring user interaction could exploit this to execute arbitrary scripts in the context of the affected application, potentially impacting confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the vulnerable application, leading to partial loss of confidentiality, integrity, and availability. The attack requires user interaction and low privileges, and the scope is changed (S:C), meaning the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix link is provided, users should monitor BdThemes advisories for updates. In the meantime, consider applying input validation and output encoding as temporary mitigations if feasible.