The Element Pack Addons for Elementor plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the render_svg() function. This function fetches SVG content using wp_safe_remote_get() and outputs it directly without proper sanitization or escaping, only applying a preg_replace() that fails to remove malicious event handlers. Consequently, authenticated users with Contributor-level privileges or higher can inject arbitrary JavaScript into SVG files. This malicious code executes whenever any user accesses a page containing the affected SVG Image Widget, potentially compromising user sessions or data. The vulnerability is tracked as CVE-2026-4655 with a CVSS 3.1 score of 6.4 (medium severity). No official fix or patch has been released as of the published date.

An attacker with Contributor-level or higher access can inject persistent malicious JavaScript into SVG images rendered by the vulnerable widget. This script executes in the context of any user viewing the affected page, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. The medium CVSS score reflects the moderate risk due to required authentication and the nature of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only. Consider disabling or removing the SVG Image Widget from the Element Pack Addons plugin to prevent exploitation. Monitor for updates from bdthemes regarding a security patch or official mitigation instructions.