WordPress Element Pack Elementor Addons <=8.8.6 Cross-Site Scripting Vulnerability Advisory

Vulnerability Overview Vulnerability Name: WordPress Element Pack Elementor Addons Plugin <= 8.8.6 Cross-Site Scripting (XSS) Vulnerability Vulnerability Type: Cross-Site Scripting (XSS) CVSS Score: 6.5 Risk Level: Low Priority Impact Scope Affected Versions: <= 8.8.6 Fixed Version: 8.8.7 or higher Vulnerability Description: Attackers can inject malicious scripts into the website to steal visitor data or hijack their accounts. Remediation Recommended Action: Immediately update the affected plugin. If an update is not possible, contact your hosting provider or website developer for assistance. Specific Steps: Update to version 8.8.7 or higher to resolve the vulnerability. Patchstack users can enable the automatic update feature to automatically update only the affected plugins. Timeline Report Date: September 17, 2026 Early Warning Date: October 7, 2026 Publication Date: October 7, 2026 Additional Information Software Type: Plugin Software Name: Element Pack Elementor Addons Reporter: nh4tvD Supplementary Notes CVSS Score Explanation: The CVSS score is a standardized and repeatable method for evaluating and ranking reported vulnerabilities, but it is not applicable to WordPress. User Interaction Requirement: Successful exploitation of this vulnerability requires a privileged user to perform specific actions, such as clicking a malicious link, visiting a fake page, or submitting a form. Contact Information More Information: For additional information or questions, please contact Patchstack. Subscription Subscription Service: Weekly WordPress security intelligence will be sent via email. Footer Links Vulnerability Mitigation: Pricing, Application Security (SCA), RapidMitigate, Threat Intelligence (API), VS Monars, VS Immunity360, VS Wordfence, Documentation, Service Status, Login Code Security: Manage VDP, Active VDP Directory, Report Vulnerability, Security Audit, Compliance (DPA), Login Bug Bounty: Bug Bounty, Leaderboard, Guidelines, Learn, Report, Discord, Login Use Cases: Website Developers, Hosting, Software Vendors, WordPress, WooCommerce Resources: Partners, Vulnerability Database, Whitepapers, Articles, Case Studies, Webinars, Vulnerability Statistics Patchstack: About, Compliance, Careers, Store, Media Kit, LinkedIn, Facebook, X Copyright Information Copyright: © 2026 Patchstack Links: DPA, Privacy Policy, Accessibility, Terms and Conditions

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Element Pack Elementor Addons <=8.8.6 Cross-Site Scripting Vulnerability Advisory

More from this source