Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons… (CVE-2026-108478)

The BdThemes Element Pack Elementor Addons (bdthemes-element-pack-lite) contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability affects versions up to 8.8.8. An attacker with low privileges and requiring user interaction could exploit this flaw to execute arbitrary scripts, impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact is limited to low confidentiality, integrity, and availability impacts, but the scope is changed, meaning the vulnerability affects resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit privileges of users and avoid interacting with untrusted content generated by the affected plugin.