# CVE-2026-119501: BdThemes Element Pack Elementor Addons stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-119501-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-119501 · Severity: medium · CVSS 6.5 · Published 2026-11-07

BdThemes Element Pack is a WordPress plugin that adds design elements and widgets to the Elementor page builder. A stored cross-site scripting (XSS) vulnerability in versions up to 10.0.2 allows authenticated attackers with contributor or higher privileges to inject malicious scripts into pages, which execute in the browsers of site visitors and can be used to steal data or hijack accounts.

Technologies: [BdThemes Element Pack Elementor Addons](https://junglewise.ai/threats/technologies/element-pack-elementor-addons). Vendors: [BdThemes](https://junglewise.ai/threats/vendors/bdthemes).

## Quick answers

**Is CVE-2026-119501 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119501 being exploited in the wild.

**How severe is CVE-2026-119501?** Medium severity, with a CVSS score of 6.5, published 7 November 2026.

**Which products and versions are affected?** BdThemes Element Pack Elementor Addons through 10.0.2.

**Is there a fix for CVE-2026-119501?** Yes: fixed in 10.0.3. Until then: Update the plugin to version 10.0.3 or later. If immediate updating is not possible, restrict contributor and higher role access to trusted users only, or disable the plugin until a patch can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119501 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119501?** Check whether you run BdThemes Element Pack Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.3

Update the plugin to version 10.0.3 or later. If immediate updating is not possible, restrict contributor and higher role access to trusted users only, or disable the plugin until a patch can be applied.

## Technical details

The plugin improperly neutralizes user input during web page generation, allowing a privileged attacker (contributor role or above) to inject malicious JavaScript that persists in the database. The vulnerability requires user interaction—a victim must view a page containing the malicious payload—but once injected, the script executes for all site visitors. A fix is available in version 10.0.3.

## Affected products

- BdThemes Element Pack Elementor Addons through 10.0.2

## Timeline

- 2026-10-29: disclosed: Reported to Patchstack
- 2026-11-07: advisory: Published by Patchstack

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-10-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-10-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [BdThemes Element Pack Elementor Addons stored XSS](https://junglewise.ai/threats/cve-2026-125708-improper-neutralization-of-input-during-web-page-generation)
- [BdThemes Element Pack Elementor Addons stored XSS](https://junglewise.ai/threats/cve-2026-124752-improper-neutralization-of-input-during-web-page-generation)
- [BdThemes Element Pack Elementor Addons stored cross-site scripting](https://junglewise.ai/threats/cve-2026-108478-improper-neutralization-of-input-during-web-page-generation)
- [BdThemes Element Pack Elementor Addons contributor XSS](https://junglewise.ai/threats/cve-2026-66574-bdthemes-element-pack-elementor-addons-contributor-xss)
- [Element Pack Elementor Addons stored XSS via uikit data attributes](https://junglewise.ai/threats/cve-2026-14817-element-pack-elementor-addons-stored-xss-via-uikit-data)