PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)

A low-privilege authenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact. Affected versions: at most 3.1.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS. This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0. The CNA vector specifies an attacker with low privileges and requires victim interaction; the exact WordPress role is not identified for authenticated access. Attacker-controlled input is stored and later rendered without adequate output neutralization, allowing script execution in the site origin when the affected content is encountered. The export does not identify the vulnerable endpoint, action, parameter or function.

Attacker-controlled input is stored and later rendered without sufficient neutralization, allowing injected script to execute when a victim views the affected output. The CNA vector requires low privileges and victim interaction. The export does not name the minimum WordPress role, endpoint, input field, rendering function or victim role; an administrator-specific path is not established. Affected versions: <= 3.1.0. The authoritative export identifies 3.1.1 as fixed for this CVE.

PowerPack Addons for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PowerPack Elementor Addons (Free Widgets, Extensions and Templates) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.