The Element Pack Addons for Elementor plugin suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). The render_svg() function fetches SVG content using wp_safe_remote_get() and outputs it directly without proper sanitization or escaping, only applying a preg_replace() that fails to remove malicious event handlers. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript into SVG files, which executes in the context of users viewing the affected pages. The vulnerability affects all versions up to and including 8.4.2. No patch or official fix has been documented as of the published date.

An attacker with Contributor-level or higher access can inject malicious JavaScript into SVG files used by the plugin's SVG Image Widget. This JavaScript executes in the browsers of users who visit pages containing the malicious widget, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher access to trusted users only. Consider disabling or removing the SVG Image Widget if possible to reduce exposure. Monitor for updates from bdthemes regarding a security patch or mitigation instructions.