CVE-2026-108488: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IdeaBox Creations PowerPack Addons for Elementor

This vulnerability in PowerPack Addons for Elementor (versions >=0 and <3.1.1) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with low privileges and requiring user interaction can exploit this to execute scripts in the context of the affected application, impacting confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires low privileges and user interaction, and the scope is changed, indicating some impact beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor vendor communications for updates and apply any official patches once available.