Stored Cross-Site Scripting in Element Pack Addons for Elementor by BDThemes

CVE-2026-4655

What is CVE-2026-4655?

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the SVG Image Widget in all versions up to and including 8.4.2. This vulnerability arises from inadequate input sanitization and output escaping of SVG content retrieved from remote URLs in the render_svg() function. The function utilizes wp_safe_remote_get() to fetch SVG content and echoes it directly to the webpage without proper sanitization. Although a preg_replace() is applied to add attributes to the SVG tag, it fails to eliminate malicious event handlers. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into SVG files, which executes whenever a user accesses a page featuring the compromised widget.

References